Most engineers think…
Most people assume threat hunting means spinning up a separate SIEM and writing hundreds of correlation rules before you can find anything. That model costs weeks and still misses attack chains that span multiple processes.
SentinelOne flips the model: the endpoint agent collects every event — process, file, network, registry, cross-process injection — and stores it in Deep Visibility, the always-on telemetry store. Storyline automatically stitches those events into a single attack narrative using a shared ID, so a hunter sees the whole chain — dropper to lateral move to exfil — in one view. You query with simple filters or with PowerQuery for complex analytics, map results to MITRE ATT&CK TTPs, and save winning hunts as STAR rules that fire automatically on future matches. No SIEM, no pre-baked signatures needed.
① What Deep Visibility actually is — the always-on telemetry store
Every SentinelOne endpoint agent continuously ships a rich stream of telemetry into the Deep Visibility data store inside the Singularity platform. The data types cover the full attack surface: process create/terminate, file create/modify/delete, network connections and DNS lookups, registry reads and writes, cross-process events (injection, handle open), and module loads. No sampling, no pre-filter — every event is captured.
Data is available for hunting from the moment it arrives and is retained on-platform for up to 365 days (depending on your licence tier), enabling both real-time detection and retrospective investigation far back in time. This matters in incident response: you can ask 'was this IOC present on any endpoint six months ago?' without querying an external SIEM.
The hunt interface lives inside the Singularity console under Visibility > Hunting. You choose a time window, pick a scope (all endpoints, a site, a group), and query the store — raw speed on billions of events because the telemetry is indexed at ingest.
Deep Visibility data retention depends on your Singularity licence tier. Entry tiers may default to 90 days; Singularity Complete and above can reach up to 365 days. Always confirm your retention window at the start of an IR engagement — querying outside the retention window returns nothing, not an error.
What types of events does SentinelOne Deep Visibility collect by default?
② Storyline auto-correlation — attack stories without writing rules
Storyline is SentinelOne's patented auto-correlation engine. Every event the agent captures is tagged with a Storyline ID — a single string that flows from the first suspicious process through every child process, injected thread, file drop and network call in that attack chain. Think of it as a breadcrumb glued to every footstep in an attack, automatically.
When a detection fires or a hunter finds an interesting event, clicking the Storyline ID opens the full attack story view: a visual timeline of every related event, the process tree from root to leaf, mapped MITRE ATT&CK techniques, and the original telemetry for each node. No need to manually pivot through logs or write a join query — the correlation is already done.
Why this matters in an interview
Storyline means SentinelOne can show analytical context at detection time, not just an alert. An analyst sees immediately whether a suspicious PowerShell process was spawned by a Word macro (phishing), a scheduled task (persistence), or a legitimate admin tool (false positive) — because the parent chain is right there in the same view.
The always-on telemetry store inside Singularity. Captures every process, file, network, registry and cross-process event from every agent and retains it for up to 365 days for hunting and IR.
A unique ID the agent attaches to every event in the same execution chain. Opens a full visual attack story — process tree, timeline, MITRE tags — with no manual correlation rules needed.
A pipeline query language for Deep Visibility. Chains filter, groupby, sort, and stats commands to do frequency analysis, parent-child stacking, and anomaly hunting across billions of events.
Storyline Active Response — a hunting query saved as a persistent automated rule. Runs continuously on live telemetry and can trigger an alert, kill a process, or isolate an endpoint automatically.
What does a Storyline ID allow a hunter to do?
③ Hunting queries — standard filters, PowerQuery, and pivot
Deep Visibility offers two query modes. Standard (guided) queries use a filter-builder UI: you select an event type (Process, File, Network, Registry…), pick a field, and set a condition. Fast for known IOCs — hash, IP, domain, command-line fragment — and accessible to analysts who are not yet comfortable writing code.
PowerQuery is the advanced mode: a pipeline language similar to Kusto/SPL where you chain EventType = 'Process' | filter ProcessName contains 'powershell' | groupby SrcProcName | sort Count desc. PowerQuery unlocks statistical hunting — frequency analysis, stacking rare parent-child pairs, computing ratios across thousands of endpoints. Hunters use it to surface anomalies that have no known IOC.
A key workflow is pivot hunting: start from one suspicious event, copy a field value (a Storyline ID, a hash, a unique string), and open a new query scoped to that value. Deep Visibility retains the query history so you can branch and return. Each pivot narrows the suspect population until you isolate the true attack path or confirm a false positive.
Searching Deep Visibility for known hashes or IPs catches commodity malware but misses living-off-the-land attacks that use legitimate binaries. Use PowerQuery frequency analysis — rare parent-child pairs, unusual command-line lengths, single-occurrence process names — to surface techniques that have no known IOC.
▶ Watch a phishing macro get hunted and blocked end-to-end
Step through how a suspicious PowerShell spawned by Word gets found in Deep Visibility, correlated in Storyline, mapped to MITRE, and locked down with a STAR rule. Press Play for the healthy hunt, then Break it to see the classic miss.
A hunter wants to find the rarest parent process spawning cmd.exe across thousands of endpoints. Which query mode is best?
④ MITRE ATT&CK mapping and converting hunts into STAR rules
Every detection and Storyline in SentinelOne arrives pre-tagged with one or more MITRE ATT&CK technique IDs (T-numbers). You can filter the hunt interface by technique, tactic, or sub-technique — for example, show me all T1059.001 (PowerShell execution) events in the last 30 days. The Singularity console links directly to the ATT&CK framework description, and you can export results to an ATT&CK Navigator layer to show coverage or gap analysis.
When a hunt surfaces a genuine pattern — say, a rare parent process spawning cmd.exe — you promote the query into a STAR rule (Storyline Active Response). The STAR rule runs continuously against live telemetry and can trigger alerts, quarantine the endpoint, or kill the process automatically without waiting for a human to re-run the hunt.
Interview framing
The cycle is: Hunt (Deep Visibility query) → correlate (Storyline) → map (MITRE TTP) → automate (STAR rule). This is exactly the loop examiners test: knowing that Storyline is retrospective context, STAR is prospective automation, and Deep Visibility is the shared telemetry layer underneath both.
Priya at a Pune fintech firm faces this
An alert fires on one endpoint but the SOC cannot tell if this is an isolated incident or an active campaign spreading across the org. The detection shows one suspicious PowerShell command but no chain.
The analyst is looking only at the alert details, not opening the Storyline view, and has not run a Deep Visibility sweep for the Storyline ID across other endpoints.
Open Deep Visibility > search the Storyline ID from the alert > pivot to see if the same ID appears on other hosts. Then run a PowerQuery grouping by the parent-child process pair to count affected endpoints.
Singularity Console > Visibility > Hunting > filter StorylineId = <value>The Storyline view reveals the PowerShell was spawned by a malicious macro in a phishing document — the same Storyline ID is present on three other machines. Priya creates a STAR rule on the unique parent-child pair so any future match triggers automatic endpoint isolation.
Re-test with a sandbox run of the same document: the STAR rule fires within seconds, isolates the endpoint, and raises an alert before the payload can phone home.
SentinelOne auto-tags TTPs, but always click through to the ATT&CK technique page and check that the observed behaviour genuinely fits the technique definition. A T1059.001 tag on legitimate PowerShell admin activity is a false positive TTP label — validate the behaviour, not just the tag.
What is the purpose of converting a Deep Visibility hunting query into a STAR rule?
🤖 Ask the AI Tutor
Tap any question — instant, scoped to this lesson. No login, no waiting.
Pre-curated from vendor docs + community Q&A, scoped to this lesson. For a live prod issue, paste your export into chat.techclick.in.
📝 Wrap-up assessment — six more
You've answered 4 inline. Six left. 70% (7 of 10) marks the lesson complete on your profile. Tap Submit all answers at the end.
🧠 In your own words
Type one line: what is the difference between Deep Visibility and Storyline in SentinelOne? Then compare with the expert version.
🗣 Teach a friend
Best way to lock it in — explain it in one line to a teammate. Tap to generate a paste-ready summary.
📖 Glossary
- Deep Visibility
- The always-on indexed telemetry data store inside Singularity that retains every endpoint event — process, file, network, registry, cross-process — for up to 365 days for hunting and IR.
- Storyline ID
- A unique identifier the SentinelOne agent attaches to every event in the same execution chain, enabling the full attack story to be auto-correlated without manual join rules.
- PowerQuery
- A pipeline query language for Deep Visibility that chains filter, groupby, sort and stats commands for frequency analysis, stacking, and anomaly hunting across billions of events.
- STAR Rule
- Storyline Active Response — a Deep Visibility hunting query saved as a persistent automated detection that runs on live telemetry and can trigger alerts, process kills, or endpoint isolation.
- Singularity Platform
- SentinelOne's unified AI security platform combining EDR, XDR, identity protection and cloud workload security, with Deep Visibility and Storyline as core hunting capabilities.
- MITRE ATT&CK Technique
- A numbered adversary technique (e.g. T1059.001 for PowerShell) in the MITRE ATT&CK framework, auto-tagged on SentinelOne detections and Storylines for TTP-based hunting and reporting.
- Living-off-the-land
- Attacker technique using legitimate OS binaries (PowerShell, wmic, certutil) to execute malicious actions, bypassing IOC-based detection and requiring behavioural/frequency hunting instead.
- Telemetry retention
- The period Deep Visibility keeps raw event data on-platform; varies by Singularity licence tier from 90 days at entry level to up to 365 days on higher tiers.
📚 Sources
- SentinelOne — Rapid Threat Hunting with Storylines: Feature Spotlight. sentinelone.com/blog/rapid-threat-hunting-with-deep-visibility-feature-spotlight/
- SentinelOne — Singularity Complete: Deep Visibility, Storyline & STAR product page. sentinelone.com/platform/singularity-complete/
- SentinelOne — PowerQuery: New Data Analytics Capabilities in Singularity XDR. sentinelone.com/blog/powerquery-brings-new-data-analytics-capabilities-to-singularity-xdr/
- SentinelOne — Customize Your EDR with Storyline Active Response (STAR). sentinelone.com/blog/customize-your-edr-to-adapt-to-your-environment-with-sentinelone-storyline-active-response-star/
- MITRE Engenuity — SentinelOne ATT&CK Evaluations configuration and results. evals.mitre.org/results/enterprise/sentinelone/
- Query.ai — SentinelOne Singularity Platform query documentation. docs.query.ai/docs/sentinelone
What's next?
Mastered hunting? Next, go deep on SentinelOne Storyline Active Response (STAR) — how to turn a hunting query into a live automated detection rule and trigger a response action without leaving the console.