Spectra Analyze and Spectra Intelligence enhance Singularity with deep file analysis, threat intelligence, and file custody to help analysts investigate alerts within their existing console.
A necessary add-on. Never a replacement.
October 20, 2026
Las Vegas, NV
In this live demo, we show how Spectra Analyze automatically pulls the file behind a SentinelOne Singularity alert, with no manual download. From the alert itself, the ReversingLabs Browser Extension puts the file details right inside the Singularity console, and a pivot into Spectra Analyze opens the full analysis. We finish by discussing capabilities such as the Flexible Intel Feed, which delivers IOCs tailored to your environment over STIX/TAXII, and the ReversingLabs MCP Server and agentic skills that help your team build SOC pipelines around SentinelOne.
Singularity's Marketplace lists sandboxing as an add-on category. Spectra Analyze puts file analysis behind every alert.
Spectra Analyze subscribes to the Singularity alert stream and fetches the file behind each alert automatically. Static decomposition and a check against the ReversingLabs corpus runs in the same pass. For a deep dive, dynamic and interactive analysis are available on-demand.
The classification is published back into the Singularity alert in seconds. The ReversingLabs Browser Extension shows file details inline in the console, and a pivot opens the full record in Spectra Analyze when an analyst wants to go deeper.
Every step starts or ends in Singularity. The analyst never has to leave the console to get a verdict.
A sandbox returns a judgment and a threat feed returns a reputation score. Neither hands back the file taken apart.
Spectra Analyze identifies more than 4,800 file types and unpacks more than 400 archive formats utilizing ReversingLabs’ proprietary, fully recursive binary analysis engine. Nested installers and archives are expanded, and every contained object is listed with its own indicators.
Alert enrichment in Singularity depends on whichever partner threat feeds a customer has separately bought and connected.
Spectra Intelligence draws on more than 450 billion validated goodware and malware samples. The goodware reference means a clean file is cleared with evidence, not a guess, so analysts can act with confidence.
Telemetry keeps the record of a file. Nothing in a retention tier keeps the file itself.
Singularity retains events, process trees, and detection history, but not the bytes. Spectra Analyze vaults every file fetched from an alert with provenance tags, so the sample is still there after the host is reimaged.
Not every deployment needs this. For the teams that do, it is already built.
For organizations who don’t want to deploy in the cloud, Spectra Analyze and Spectra Intelligence provide on-premises and fully air-gapped options. File analysis and intelligence run natively inside the disconnected network, with no cloud call and no exception carved into the firewall.
File intelligence
Validated goodware and malware samples stand behind every verdict.
Built for analyst speed
Verdicts publish back into the Singularity alert, so triage does not leave the console.
On-premises or fully air-gapped, with no additional endpoint agent.
Deep file coverage
Talk to us about adding Spectra Analyze and Spectra Intelligence behind your SentinelOne alerts.
Each file is classified as goodware, suspicious, or malicious. A malicious verdict corroborates the Singularity detection and adds the secondary indicators behind it, which gives detection engineers material for new rules and responders what they need to scope the incident.
Two ReversingLabs feeds deliver IOCs over STIX/TAXII. The Flexible Intel Feed provides IOCs tailored to your environment. The Ransomware TAXII Feed supports early detection of ransomware, with curated IOCs that cover ransomware file hashes, command-and-control (C2) infrastructure, and payload download URLs.
The Spectra Analyze vault reruns YARA and reputation checks as the threat landscape shifts. When a sample is reclassified weeks or months later, the new indicators go back into Singularity through the ReversingLabs Flexible Intel Feed.
A year of retention tells you the file was there. Custody lets you ask it something new.
SentinelOne has extended Singularity to on-premises, sovereign, and air-gapped deployments for government, defense, and financial services teams. Traditional sandbox and threat intelligence come from cloud-hosted solutions, which are severely degraded when they cannot reach a network.
Spectra Analyze and Spectra Intelligence run inside the network with Singularity, and need nothing outside the wire.
File types identified, with 400+ archive formats unpacked layer by layer.
One integration, four paths. Singularity stays the control, and ReversingLabs adds analysis, intelligence, and custody around it.
The agentic path uses the ReversingLabs MCP Server and agentic skills, which give teams the building blocks for custom SOC pipelines around SentinelOne.
.svg)
