SentinelOne Storyline, ActiveEDR, Ranger & Rollback — Attack Correlation & One-Click Remediation

① Storyline — the whole attack as one connected story

The headline idea: SentinelOne does not hand you a pile of disconnected alerts. As the on-agent AI watches the endpoint, Storyline automatically links every related activity — a process spawning a child, a file being written or encrypted, a network connection, a registry edit — into one attack story. That whole story shares one identifier, the Storyline ID.

So instead of correlating logs by hand, you click a Storyline ID and the console draws the full picture: where the attack started, the process tree it spawned, and a timeline of what it touched. This correlation happens on the agent in real time, which is why it survives reboots and works even when the machine is offline. In an interview, the one-liner is: Storyline is automatic event correlation, and the Storyline ID is the key that opens the entire story.

② ActiveEDR — the analyst experience and hunting

ActiveEDR is the human-facing layer built on top of Storyline. The agent has already done the correlation, so the analyst's job becomes reading and deciding, not stitching events together. Click the Storyline ID and you get a high-level origin diagram plus a process tree and timeline showing exactly what spawned what, in order, with full context.

Hunting on EDR data

The same rich data is huntable. Analysts query historical endpoint telemetry to chase indicators across the fleet, and with Storyline Active Response (STAR) you turn a hunt into a custom, always-on detection rule that auto-responds the next time the behaviour appears. The interview line: Storyline builds the story; ActiveEDR is how a human reads it and hunts on it.

③ Ranger — see and control every device, no new agents

You can only protect what you can see. Ranger — now Singularity Network Discovery — solves visibility without deploying anything new. SentinelOne intelligently elects some of your existing agents to act as passive sensors: they listen to broadcast traffic (ARP, DHCP and similar) and fingerprint every IP-enabled device on the network, managed or not.

The payoff is twofold. First, an inventory of what is connected where — including unmanaged IoT and OT, the things attackers love. Second, rogue-device control: with a click you can isolate a suspicious or unmanaged device so it cannot move laterally to your managed Windows, Mac and Linux hosts. Crucially this needs no extra hardware, no SPAN/TAP, no network changes — it is part of the agent you already run. Interview framing: Ranger is agentless discovery that rides your existing agents.

④ Remediate & rollback — one click off the same story

Because Storyline already knows every artefact an attack touched, response is one decision, not fifty. One-click Remediate kills the malicious processes and cleans up everything in the Storyline — files dropped, persistence, registry changes — across the whole story at once. Rollback goes further on Windows: it reverts files that ransomware maliciously encrypted or deleted back to their pre-attack state.

How rollback actually works

Rollback is built on Microsoft's Volume Shadow Copy Service (VSS). The agent watches file activity at the kernel level and SentinelOne takes VSS snapshots (by default every few hours), while protecting the VSS service itself so ransomware cannot wipe the shadow copies first. Because it depends on VSS, full rollback is Windows-only — Mac and Linux lack the same native shadow-copy technology. Above all this sits Singularity XDR with marketplace integrations to ingest third-party data, and Purple AI, the natural-language and agentic investigation assistant.