In short: SentinelOne Wayfinder Threat Hunting is a managed service in which SentinelOne analysts, using Google Threat Intelligence, hunt continuously through your EDR telemetry for indicators of compromise and attacker behaviour. Validated findings appear in your Singularity console and Flash Reports cover emerging threats. It is licensed per endpoint, monthly or annually.
What Wayfinder Threat Hunting is
Automated detection catches most attacks, but determined attackers try to blend in using legitimate tools and stolen credentials. Threat hunting is the practice of searching proactively for those signs rather than waiting for an alert.
Wayfinder Threat Hunting is SentinelOne's managed hunting service, part of its Wayfinder threat detection and response (TDR) portfolio. SentinelOne's hunters combine their own research with Google Threat Intelligence, drawing on continuously updated indicators of compromise, threat actor attribution and campaign context, and search your Singularity telemetry for matches and suspicious behaviour.
What the service includes
- Continuous hunts based on indicators of compromise and behaviour, run around the clock
- Curated detections: hunters validate suspicious activity against your real telemetry, so you receive confirmed, enriched findings rather than raw noise
- Findings in your console: hunt results and detection status appear directly in Singularity
- Flash Reports on emerging threats, active adversaries and new techniques
| Wayfinder Threat Hunting | Vigilance MDR (Essentials or Elite) | |
|---|---|---|
| Continuous IOC and behavioural hunts | Yes | Yes |
| Periodic emerging-threat and hypothesis-based hunts | No | Yes |
| 24/7 monitoring, triage and response | No | Yes |
Threat hunting finds and reports threats; it does not include the 24/7 response that MDR provides. If you need someone to act on findings at 3am, choose MDR.
How Wayfinder Threat Hunting is licensed
Wayfinder Threat Hunting is an add-on licensed per endpoint, on top of your SentinelOne edition. Hunters need searchable EDR telemetry, so covered devices should run Singularity Complete, and longer Deep Visibility retention lets them look further back.
We can supply it month to month or on an annual commitment billed monthly. Pricing depends on endpoint numbers and term, so ask us for a quote.
Who it suits
- organisations with an in-house IT or security team that responds to incidents but lacks time or specialist skills for proactive hunting
- teams that want regular, credible intelligence on new threats relevant to their estate
If you have no one to respond out of hours, start with Vigilance MDR instead, since MDR includes hunting.
Making the most of it
Hunting findings are only valuable if someone acts on them. We agree with you who receives findings and Flash Reports, how quickly each type should be handled and when we should step in. Pairing threat hunting with Purple AI lets your team ask follow-up questions about a finding in plain English, and Singularity Identity gives hunters more context on credential misuse.
How we help
- Confirm the foundations: we check covered devices are on Singularity Complete and that retention is long enough for hunters to look back.
- Route the findings: we agree who receives hunt findings and Flash Reports, and how quickly each type should be handled.
- Act on what is found: we can pick up findings on your behalf, from isolating a device to resetting credentials.
- Review regularly: we go through findings with you and tell you honestly if MDR would now be the better fit.
See other managed options in EDR, XDR and MDR.
How Forever Systems supplies your software licences
Forever Systems Ltd supplies business software subscriptions to UK organisations from one account, with one monthly invoice and a UK team who know the products.
- The right edition first time: we check what you need before you buy, so you are not paying for features you will never use
- Monthly or annual terms where the vendor offers them, and help timing renewals and commitments
- Licence changes handled for you: add or remove users, upgrade editions and true-up without starting a new contract
- Deployment and support from engineers who run these products every day, not just a reseller account
- Consolidated billing and renewal reminders so nothing lapses unexpectedly
We work with businesses, schools, charities and public sector organisations of all sizes.
Need a licence quote or a second opinion on your renewal?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
What is SentinelOne Wayfinder Threat Hunting?
It is SentinelOne's managed threat hunting service. Analysts use Google Threat Intelligence to hunt through your EDR telemetry, validate suspicious activity and report findings in your Singularity console.
Is threat hunting the same as MDR?
No. Threat hunting proactively searches for hidden threats and reports them. MDR adds 24/7 monitoring, triage and response, and SentinelOne's MDR Essentials and Elite levels also include periodic emerging-threat and hypothesis-based hunts.
Was this service previously called WatchTower?
SentinelOne's earlier managed threat hunting service was called WatchTower. SentinelOne now markets managed hunting as Wayfinder Threat Hunting within the Wayfinder portfolio.