SentinelOne Singularity Ranger — Agentless Network Discovery & Attack Surface Mapping

① What Singularity Ranger actually is — agentless discovery without new hardware

Singularity Ranger (now branded Singularity Network Discovery) is the network visibility layer of the SentinelOne Singularity platform. Its defining property: it discovers every IP-enabled device on the network — unmanaged, IoT, legacy, and rogue — without installing an agent on the discovered devices and without deploying any dedicated scanner hardware.

Ranger ships as a feature within the Singularity Complete and Singularity Control tiers. Enabling it takes a policy flip in the console; no network re-cabling, no new VLAN, no sensor box to rack. The inventory it builds appears directly in the Singularity console alongside endpoint telemetry, so analysts get a single pane of glass across managed endpoints and everything else on the wire.

② How the sensors work — managed endpoints as distributed listeners

Ranger works by electing a subset of your existing managed endpoints to act as passive network sensors. Elected endpoints listen for broadcast traffic — ARP, DHCP, mDNS and similar protocol chatter — that all IP devices emit naturally. No traffic is diverted; the endpoint simply records what it already sees on the wire.

Passive vs active scanning

Passive observation alone captures devices that broadcast. For quieter assets (printers, cameras, OT controllers that rarely talk), Ranger optionally runs active scans using protocols you configure — ICMP, SNMP, UDP, TCP, SMB and more — against IP ranges you specify. Active scans are policy-controlled so you can exclude sensitive OT subnets. The elected-sensor design means discovery is distributed: one sensor per subnet, no single point of failure, no centralised probe box.

③ ML-based fingerprinting — turning a MAC address into a full device profile

Seeing a device on the wire is just the first step. Ranger's ML-based fingerprinting engine classifies each discovered asset by analysing the combination of broadcast signatures, active-scan responses, and any device-specific identifiers it can observe. The output is a device profile containing manufacturer, device type, operating system, firmware version clues, and a list of active services — all without authenticating to or installing anything on the device.

When a newly-discovered device does not have a SentinelOne agent, Ranger flags it as unmanaged and surfaces it in the console with a risk signal. If the device matches no known corporate asset inventory record, it can be flagged as rogue. Admins can then trigger a STAR rule to block network communication from the unknown device directly from the console.

④ Attack-surface mapping & automated response — from inventory to action

Ranger's discovery output feeds the Singularity asset inventory, giving you a real-time map of the network attack surface: which devices are unmanaged, which are running outdated OS versions, which appeared for the first time today. This is the data that turns a reactive SOC into a proactive one — you cannot patch or protect what you cannot see.

Automated response with STAR

Because Ranger lives inside Singularity, you can write STAR automated-response rules directly against discovery events. A common pattern: alert on any new device without an agent joining a protected VLAN, and optionally block communications from that device using the managed endpoints already on the segment. No firewall rule change needed. For interview prep, the key phrase is: Ranger closes the visibility gap between the endpoints you manage and everything else on the subnet.