SentinelOne EDR

Cloud Threat Intelligence / Reputation Engine

A rules-based, signature/reputation engine that runs locally on the agent. It maintains an on-device blocklist of known-malicious file hashes consolidated from multiple feeds (VirusTotal, ReversingLabs, SentinelOne's research team, and other agents in your tenant). The engine uses a reputation lookup, comparing a file hash to those on the local blocklist, and is nearly 100% effective in detecting known malware. The Cloud Threat Intelligence Engine runs locally on the agent anytime a file is written, modified, copied, or executed. Marking a hash as malicious anywhere in the tenant pushes the updated blocklist to all deployed agents.

Static AI Engine (pre-execution)

A signatureless deep-learning model that inspects files before they run. It scans files at the PE (Portable Executable) level using deep learning models, extracting static attributes from binaries to predict maliciousness without executing them. Examining a potentially malicious file before it executes means your endpoint and cloud workloads are protected from malware before it has the opportunity to run. It is computationally cheap relative to behavioral analysis but cannot see fileless/in-memory threats. Model aggressiveness is tunable (trade-off between detection rate and false positives).

Behavioral AI Engine / ActiveEDR (post-execution)

Continuously monitors all processes as they execute at the kernel level. The Behavioral AI Engine can detect memory injection attacks. The local engine is vector-agnostic: it works with file-based malware, scripts, weaponized documents, lateral movement, fileless malware, and even zero-days. It runs autonomously on-device with no cloud round-trip, making mitigation decisions at machine speed at the edge.

Anti-Exploitation / Fileless Engine

This AI engine is focused on memory exploits and fileless attack techniques like web-related & command line exploits. It watches for in-memory execution patterns such as heap sprays, ROP, and credential dumping (e.g., LSASS access), catching threats that never write a file to disk.

Lateral Movement Engine

This AI engine detects attacks initiated by remote devices. It flags activity such as remote execution via PsExec/SMB and credential-based pivoting from one host to another (e.g., a remote machine encrypting shares).