Absolutely yes! Network Discovery policies have several settings to maintain administrative control over what is and is not scanned. A few examples…. You can set a minimum number of Sentinel agents that must be on a subnet before the system event considers it as a possibility. If you set the number at, say 5, small home networks and coffee shops are unlikely to be scanned because you probably will never have 5 managed devices on those networks at any one time. Further, administrators can require an explicit “yes, scan this network” from within the SentinelOne Singularity console to further control what is analyzed.

Unmanaged Assets and Network Discovery are both built into the agent. The capabilities differ based on the purchased license level. Unmanaged Assets is a free feature included in the Singularity Complete and Singularity Control products and informs administrators which devices on the network still require a SentinelOne agent. Network Discovery is a full-featured add-on product with multiple added network visibility, deployment and control capabilities that report on all IP-enabled device types.

SentinelOne understands this concern and has built in per-network policy controls so that you can use every type of scan technique on some networks but then selectively use only certain network learning methods on others. For example, you can turn off active scan probes altogether and just rely on passive network listening on an OT network. Or, you might use passive listening plus ICMP and SNMP active scanning probes but NOT use TCP connect scans because you are worried about destabilizing certain types of control units that use IP and the SCADA protocol. These are just examples. The point is, administrators can mix and match a wide variety of scanning and passive listening techniques on a per network basis to discover what is connected where and how it is communicating.

Yes! Network Discovery will build out an asset inventory for every scanned network and let you visualize or export the data.

When an administrator chooses to block a device, that device is effectively isolated from all SentinelOne-managed Windows, Mac, and Linux hosts. This is accomplished using local network control firewall rules as enforced by the SentinelOne agent on those devices.

Network Discovery combines capabilities with Singularity Data Lake and Storyline Active Response Engine (STAR) to alert you when a new device without a SentinelOne agent has connected to the networks of your choice. You may then take the response of your choosing including block communications from the unknown device.