SentinelOne has expanded its Wayfinder Threat Hunting service into AWS, Azure, and Google Cloud, giving subscribers one continuous, expert-led hunting capability across endpoints, identities, and cloud workloads. The new Wayfinder Threat Hunting for Cloud layer adds control-plane coverage on top of the existing endpoint hunting and the identity hunting already in place for Okta and Microsoft Entra ID.<\/p>\n
The cloud extension combines SentinelOne’s AI-powered Singularity Platform telemetry with human-led hunting. Coverage spans cloud control-plane abuse, IAM privilege escalation, unauthorized access, and data exfiltration. Continuous, expert-led hunting runs across AWS, Azure, and GCP control-plane activity so defenders get a single view rather than stitched-together logs from three providers.<\/p>\n
Hunts in the new cloud package target specific attacker tradecraft:<\/p>\n
Curated indicators and behavioral rules are mapped to MITRE ATT&CK techniques, and findings arrive with Purple AI summaries for triage.<\/p>\n
The cloud has become an even more attractive attack surface as AI adoption has accelerated. A threat actor who compromises a cloud identity or exploits a misconfiguration can move directly to data without ever touching an endpoint, often leaving little trace in the logs a security team already watches. That gap between endpoint telemetry and cloud activity is what the Wayfinder expansion is built to close.<\/p>\n
Wayfinder Threat Hunting has grown in three stages: first across the endpoint, then into identity with hunting for Okta and Microsoft Entra ID, and now into the cloud control plane itself. As with the rest of Wayfinder, the new cloud capability uses threat intelligence and intrusion findings from both SentinelOne and Google Threat Intelligence in a single hunting workflow.<\/p>\n
Wayfinder Threat Hunting for Cloud is generally available to all existing Wayfinder Threat Hunting customers. Enablement runs through existing Singularity Marketplace plugins for each cloud provider. Customers already using Wayfinder Threat Hunting on identities in Microsoft Entra ID require no additional setup for Azure environments.<\/p>\n
It is the cloud extension of SentinelOne’s Wayfinder Threat Hunting service, providing continuous, expert-led hunting across AWS, Azure, and GCP control-plane activity. Coverage includes cloud control-plane abuse, IAM privilege escalation, unauthorized access, and data exfiltration.<\/p>\n
The service supports AWS, Azure, and Google Cloud, and combines SentinelOne’s Singularity Platform telemetry with human-led hunting alongside threat intelligence from SentinelOne and Google Threat Intelligence.<\/p>\n
It is generally available to existing Wayfinder Threat Hunting customers through Singularity Marketplace plugins for each cloud provider. Customers already using Wayfinder Threat Hunting on Microsoft Entra ID identities do not need extra setup for Azure environments.<\/p>\n