#detection-rules
All CosmicBytez Labs articles tagged #detection-rules, across news, security advisories, how-to guides, and projects.
- HOWTO
SentinelOne Application Control Policies
Organizations face security risks from unauthorized applications, malware disguised as legitimate software, and shadow IT installations that bypass...
- HOWTO
SentinelOne Control vs Complete Feature Comparison
This document provides a comprehensive comparison between SentinelOne Singularity Control and Singularity Complete SKUs to help MSP teams understand the...
- HOWTO
SentinelOne Create and Manage Exclusion Policies
SentinelOne exclusion policies allow security teams to prevent false-positive detections and performance issues by excluding specific files, folders,...
- HOWTO
SentinelOne Data Retention and Storage Management
Organizations using SentinelOne Singularity Complete receive 14-365+ days of Deep Visibility EDR data retention by default. This historical telemetry...
- HOWTO
SentinelOne Deep Visibility Threat Hunting
Deep Visibility is SentinelOne's EDR telemetry engine that provides comprehensive endpoint data collection for threat hunting, incident investigation, and...
- HOWTO
SentinelOne Deploy Agent Manual Installation
Manual SentinelOne agent installation is used when automated deployment methods (GPO, RMM, SCCM) are unavailable or when installing on standalone...
- HOWTO
SentinelOne Deploy Agent via Group Policy
Deploying SentinelOne agents across Windows endpoints at scale using Active Directory Group Policy Objects (GPO) enables centralized, automated agent...
- HOWTO
Deploy SentinelOne Policy
Deploy, manage, and validate SentinelOne security policies across your endpoint estate using the SentinelOne Management API. This automated workflow supports:
- HOWTO
SentinelOne Device Control: Block USB & Bluetooth Devices
How to block USB drives and Bluetooth peripherals with SentinelOne Device Control — audit in Monitor mode, then enforce allow/block policies safely.
- HOWTO
SentinelOne File Fetch and Forensic File Collection
During threat investigations, security analysts need to retrieve suspicious files from endpoints for deeper forensic analysis. Traditional methods...
- HOWTO
SentinelOne Firewall Control Management
Traditional endpoint protection focuses on file-based malware, but network-based attacks (lateral movement, command-and-control callbacks, port scanning,...
- HOWTO
SentinelOne Forensics Rollback and Remediation
This document provides comprehensive procedures for forensic evidence collection, ransomware rollback, and threat remediation using SentinelOne Complete...
- HOWTO
SentinelOne Health Check: Agent Status Monitoring Guide
Organizations deploying SentinelOne endpoint protection require continuous monitoring of agent health to ensure comprehensive threat coverage across their...
- HOWTO
Invoke SentinelOne Threat Hunt
Proactive threat hunting is essential for identifying sophisticated threats that evade automated detection systems. This script automates the process of...
- HOWTO
SentinelOne MITRE ATT&CK Threat Hunting
The MITRE ATT&CK framework catalogs 14 tactics and 200+ techniques used by adversaries. Security teams need to proactively hunt for these techniques in...
- HOWTO
SentinelOne MSP Client Onboarding
This runbook provides a standardized process for onboarding new MSP clients to SentinelOne Singularity Complete. Following this methodology ensures...
- HOWTO
SentinelOne Policy Configuration Best Practices
This guide provides comprehensive best practices for configuring SentinelOne policies in MSP environments managing multiple client sites with Singularity...
- HOWTO
SentinelOne PowerShell API Automation
The SentinelOne Management Console REST API enables automation of administrative tasks, reporting, threat response, and integration with existing security...
- HOWTO
SentinelOne PowerShell Automation Scripts
This document provides a comprehensive library of production-ready PowerShell scripts for automating SentinelOne operations in an MSP environment. These...
- HOWTO
SentinelOne Purple AI Usage Guide
Security Operations Centers (SOCs) face overwhelming alert volumes, complex threat investigations, and resource constraints. Analysts spend hours writing...
- HOWTO
SentinelOne Ranger Network Discovery and IoT Visibility
Modern enterprise networks contain a complex mix of managed endpoints (workstations, servers), IoT devices (IP cameras, printers, smart building systems),...
- HOWTO
SentinelOne Remote Shell Operations
Full Remote Shell is a SentinelOne Complete feature that provides authorized administrators with secure, native command-line access to managed endpoints...
- HOWTO
SentinelOne RMM Integration Guide
This runbook provides comprehensive guidance for integrating SentinelOne Singularity Complete with NinjaRMM and other RMM platforms. Proper RMM...
- HOWTO
SentinelOne STAR Advanced Automation and Watchlists
Security teams face the challenge of detecting organization-specific threats, insider threats, and policy violations that generic detection rules cannot...
- HOWTO
SentinelOne STAR Custom Detection Rules
Storyline Active Response (STAR) is SentinelOne's cloud-based automated hunting, detection, and response engine that allows security teams to create...
- HOWTO
SentinelOne Threat Investigation Workflow
When SentinelOne detects a threat on an endpoint, security analysts must quickly investigate the alert to determine if it's a genuine malware infection,...
- HOWTO
SentinelOne Timeline Forensics and Attack Chain Analysis
Understanding the complete attack chain requires correlating hundreds of events (process creation, network connections, file modifications, registry...