Containment that follows the attack to your file servers.

Helm watches your files. When it detects ransomware, it can have SentinelOne take the devices and file servers involved off the network. Your data and your devices are contained together, and your team stays in control.

The fewer files ransomware encrypts, the less there is to restore. Helm acts at the data layer, on file shares, servers and Microsoft 365, where most of the damage lands, and contains the attack on fixed rules your team can read. It also covers the shares and storage that no endpoint agent runs on.

SentinelOne Singularity combines endpoint protection, EDR and automated remediation in a single agent. It can isolate devices and roll an endpoint back after ransomware, using protected Volume Shadow Copy snapshots to restore files and settings on that machine. SentinelOne restores the endpoint. Helm protects the data around it.

When Helm contains an attack, it can find the devices behind it in SentinelOne, by device name or by the last user logged on, and disconnect them from the network through SentinelOne’s own agent actions. For file servers, Helm can do this automatically once its alert rate for that server crosses a threshold you set.

Every action is recorded in the Helm incident, and devices are reconnected once they are confirmed clean.

Helm adds the data layer and acts on the rules you set; your agents carry out the action on each device. If parts of your estate run Microsoft Defender or CrowdStrike, Helm contains through those too.

See all integrations, or talk to us about adding Helm to your SentinelOne environment.