SentinelOne Singularity AI SIEM, Hyperautomation, Purple AI & Observo AI

My main use case for SentinelOne Singularity AI SIEM is centralized log management, fast threat detection, and creating a clear dashboard that helps us spot issues quickly.

For example, we spotted repeated failed logins from one source IP to a specific destination late at night, and the alert showed up clearly on the dashboard, enabling us to respond fast and block the noise.

It helps us save time, keep everything organized, and make decisions quickly without chasing logs across different tools.

SentinelOne Singularity AI SIEM has positively impacted my organization by making threat detection faster and easier to understand, enabling us to respond quicker and spend less time searching for information.

In our case, the dashboard reduces the time to understand an alert. Previously, we had to read raw logs across tools, which could take 15 to 20 minutes per alert, but now with the dashboard and filter views, we are closer to five minutes to understand what is happening.

SentinelOne Singularity AI SIEM has improved our SOC's efficiency significantly by helping prioritize important alerts, so we spend less time investigating the ones that do not matter.

It improved response time by helping us spot suspicious activity quickly and focus on critical alerts, preventing us from being stuck in manual investigation.

In our experience, using SentinelOne Singularity AI SIEM has helped reduce the risk of downtime by catching suspicious activity earlier, leading to smoother operations and quicker incident handling.

Since implementing SentinelOne Singularity AI SIEM, our organization's security posture feels stronger and more proactive.

Our security posture has improved with better visibility across security events, faster threat detection, and improved incident response.

Consolidating tools into SentinelOne Singularity AI SIEM has reduced operational overhead since our team is not bouncing between separate dashboards.

The best part of SentinelOne Singularity AI SIEM is the clear dashboard that makes threat detection easy to understand, plus a simple alert mechanism that saves time, and centralizing logs so we do not jump between tools is also a significant win.

The dashboard has made the biggest difference for me because it gives a quick, clear picture, enabling us to understand what is happening without guessing.

The combination of a clean dashboard and centralized logs is what makes everything faster and less stressful because it gives us confidence that we are not missing something important.

The governance and security aspects of SentinelOne Singularity AI SIEM feel solid for day-to-day use. Role-based access made access control straightforward, and the platform seems secure and stable with nothing that raised a red flag on compliance or data handling.

The accuracy and reliability of SentinelOne Singularity AI SIEM feel solid. Alerts are consistent and not fluctuating erratically, so we do not waste time chasing false positives.

My impression of the AI-driven threat detection capabilities of SentinelOne Singularity AI SIEM is strong and steady. The alerts are consistent, and the details align with the logs, making its detection feel trustworthy.

The real-time monitoring feature of SentinelOne Singularity AI SIEM is quite useful. It lets us spot suspicious activity as it happens, allowing us to respond without much delay.

We have used the automated workflow features of SentinelOne Singularity AI SIEM to reduce repetitive tasks, especially around alert handling and basic investigation steps.

SentinelOne Singularity AI SIEM's AI-driven analytics has helped reduce false positives to some extent. The AI analytics pick up suspicious patterns more accurately, allowing our SOC to focus more on the real threats.

It would be helpful if some alerts had cleaner, clearer explanations right away, such as suggesting next steps inside the alert, and fewer clicks to get from alert to raw event details would make the triage even faster.

Integration could be more plug-and-play, and improving built-in guidance for new analysts would help cut the learning curve. Performance-wise, it is adequate for us, but easier bulk searches would make investigations smoother.

It would be helpful for each alert to come with clear suggested next steps right inside the alert, so analysts do not have to guess or click around too much. Making integration more plug-and-play would smooth out setup for new data sources.

I have been using SentinelOne Singularity AI SIEM for around a year.

SentinelOne Singularity AI SIEM has been stable in our environment, handling our data volumes without causing disruption.

SentinelOne Singularity AI SIEM has been stable and adaptable as our data volume and IT setup became more complex.

SentinelOne Singularity AI SIEM is scalable and handles growing log volume while supporting monitoring across multiple services.

The customer support was helpful, responsive, and easy to work with.

I would rate the customer support an eight out of ten. The support team was responsive, helpful, and professional.

Before, I used traditional SIEM tools for log monitoring and analysis, but I switched to SentinelOne Singularity AI SIEM because I wanted better centralized visibility and faster threat detection.

I have seen a positive return on investment through time saving and improved team efficiency since I can now understand an alert in about five minutes.

Pricing and licensing for SentinelOne Singularity AI SIEM feel reasonable for what I get. The initial setup took some planning, but once up and running, day-to-day management becomes easier.

I evaluated a few other SIEM solutions, including Splunk and IBM QRadar, comparing their log management, threat detection, alerting, and integration capabilities.

I give SentinelOne Singularity AI SIEM an eight out of ten.

I chose eight out of ten because it has been reliable, clear, and helpful, but clearer next steps inside alerts and easier integration would push it to ten for me.

My advice would be to understand your security needs and log volume, take time to configure integration, and customize alerts to your environment.

I use SentinelOne Singularity AI SIEM for security operations. An AI-powered SIEM uses machine learning, and for us, the primary value is reducing manual investigation effort while improving the detection of threats that traditional rule-based SIEMs may miss. SentinelOne Singularity AI SIEM has Purple AI for that purpose. Analysts can use natural language to investigate security data and generate queries. It also has unified security data analytics, which allows us to analyze endpoints, firewalls, identity, cloud, and third-party security logs from a common platform without switching between tools. If a potentially compromised employee account exists, a traditional SIEM may generate separate alerts for each event. However, SentinelOne Singularity AI SIEM can help correlate the events, summarize the investigation, and identify the relationship between them.

A particular example of my use is creating a detection rule. I used SentinelOne Singularity AI SIEM AI and machine capabilities to develop detection logic, generate a query, and ingest logs. Purple AI helped me build the detection logic, but I still validated and deployed the rule. I wanted to create a custom detection rule for external port scanning activity. I analyzed the available FortiGate firewall logs and identified the source IPs originating from external networks. I grouped events by source IP and destination IP, counted the unique destination ports scanned, and used Purple AI by entering a prompt regarding all of this. I reviewed the generated query and confirmed the fields that match with my FortiGate logs. I executed the query and adjusted the threshold, then created the scheduled detection rule using the validated query. I tested it and performed tuning as required.

I also use SentinelOne Singularity AI SIEM for rule and detection development. I developed detections for repetitive failed VPN login attempts. I analyzed gaps with Purple AI and detected data exfiltration using Purple AI.

SentinelOne Singularity AI SIEM has the potential to improve my organization's security operations by reducing manual investigation efforts, accelerating threat detection, and improving the efficiency of the SOC. Its AI-powered threat hunting and detection engineering capabilities help us develop better detection rules, identify security threats more effectively, and streamline incident response. This has led to improved operational efficiency and better utilization of our security analysts' time.

I have observed time savings in security investigations and detection rule development. AI-assisted techniques reduce the time spent manually writing queries and analyzing security logs. It helps correlate related events and identify relevant evidence faster, allowing our SOC to investigate incidents more efficiently and focus on critical security activities. An example of time savings I have observed is with AI SIEM threat hunting. AI performed investigation using natural language and quickly identified relevant activity, which reduces the time spent on manual log analysis and allows our SOC to focus on validating findings and responding to threats. It also simplifies detection rule development by generating and refining queries.

I have used automated workflows to streamline repetitive security operations tasks. Automating routine activities such as alert enrichment or event handling and response helps reduce manual intervention and improves operational efficiency. This also reduces alert fatigue, allowing our SOC team to focus more on threat investigation and incident response rather than repetitive administrative tasks.

The automated workflows have the potential to reduce false positives by enriching the alerts with contextual information and filtering. This has reduced unnecessary alert handling and improved SOC efficiency. However, the effectiveness depends on the quality of detection rules and workflow configurations. Continuous tuning and validation will remain necessary to ensure genuine intrusions are not overlooked.

I find SentinelOne Singularity AI SIEM efficient in supporting our SOC operations. Its AI-powered threat hunting and investigation capabilities help reduce the effort of manually analyzing security logs and correlating events. The platform also assists in developing and refining detection queries, improving the efficiency of threat investigations. However, the accuracy of the generated queries and the need for manual validation can affect the overall efficiency, particularly when working with complex or third-party log sources.

I assess SentinelOne Singularity AI SIEM efficiency by measuring how much time it saves in daily SOC operations, how accurately it identifies threats, and how much manual work remains. I also assess the efficiency of SentinelOne Singularity AI SIEM based on security activities done manually for threat hunting, detection, and incidents. For example, investigating external port scanning activity traditionally requires manually filtering firewall logs, correlating events, and calculating investigation reports. Assisted investigation helps simplify this process by identifying relevant events and assisting with query development. This improves detection efficiency, although the generated queries still require analysts' modification.

If a Windows endpoint starts communicating with a suspicious external IP, SentinelOne Singularity AI SIEM can correlate firewall logs with endpoint telemetry to help identify the affected system. If the activity is confirmed as malicious, the SOC can isolate the endpoint. SentinelOne Singularity AI SIEM does not directly prevent system downtime. It is entirely dependent on detection quality, response speed, and whether required mitigation and response actions were taken. SentinelOne Singularity AI SIEM can help reduce the potential impact of security events on system availability by improving threat detection and investigation speed.

I believe my organization's security posture has improved with the implementation of SentinelOne Singularity AI SIEM. The platform provides better visibility into security events across multiple data sources and helps identify suspicious activities more efficiently. Its AI-powered threat hunting, event correlation, and investigation capabilities support faster threat identification and improve our ability to detect potential attacks. It also assists in developing and refining detection rules, helping us address detection gaps and strengthen our monitoring capabilities. Overall, the platform has improved our security visibility and investigation efficiency, while continuous detection tuning and analysis remain essential to maintaining an effective security posture.

Consolidating security data from multiple sources into SentinelOne Singularity AI SIEM has helped streamline our SOC operation by providing a centralized view of security events. Instead of switching between different tools to investigate suspicious activities, analysts can correlate and analyze data from multiple sources within a single platform. This improves investigation efficiency, reduces manual effort, and simplifies threat hunting. It helps our team identify relationships between events that might otherwise remain unnoticed.

The best features of SentinelOne Singularity AI SIEM are the AI-powered threat hunting and investigation, natural language search, and the ability to query data so I can search with my own language with Purple AI. Custom detection rules and correlation of security events across multiple data sources, real-time threat detection and alerting, integration with SentinelOne EDR and XDR and third-party security products, data normalization and log parsing, historical log analysis for identifying attack patterns, and automated response and orchestration workflows are all valuable.

AI-powered threat hunting using natural language stands out the most to me. It allows me to investigate security data using plain language questions instead of manually writing complex queries. This reduces the time required for threat hunting and makes investigations more accessible for analysts who are less familiar with query languages. I was not that much familiar with the SentinelOne query language before. During the first six months, I was not familiar with the query language, but now I am an expert. However, analysts who are less familiar with query languages can use Purple AI to query SentinelOne data using plain English.

Another standout feature worth mentioning is AI-assisted detection engineering. Unlike simply using AI to summarize events, this focuses on helping me develop, investigate, and refine detection logic. It can make detection engineering more accessible and reduce the manual effort involved in writing and troubleshooting queries. Other features that may stand out are assisted investigation, explainable AI verdicts, and OCSF normalized data. Assisted investigation is a strong feature to mention alongside the features I have mentioned.

SentinelOne Singularity AI SIEM can improve in several areas. AI accuracy is one area where the platform can improve the accuracy of AI-generated queries and investigation findings, especially for complex log formats. Detection rule creation should be easier, making it simpler to convert AI-generated queries into production-ready detection rules. False positive reduction is another important area where improved detection tuning is needed to reduce unnecessary alerts and manual triage. For example, SentinelOne Singularity AI SIEM can catch SentinelAgent.exe as a potential threat, but it should not because it is the agent of SentinelOne itself. Third-party integrations should be improved because the platform does not integrate with some Microsoft-related products currently. Expanding out-of-the-box integrations and simplifying the onboarding of non-SentinelOne data sources would be beneficial.

Log parsing should be improved by enhancing automatic extraction and normalization for custom and third-party logs. Investigation transparency should provide clearer explanations of why an event was classified as suspicious or malicious because the AI is constantly classifying SentinelOne agent as suspicious. The platform should support more formats and optimize costs by improving query execution and optimizing data and storage costs.

The accuracy of SentinelOne Singularity AI SIEM is generally useful for threat hunting and security investigations. However, AI-generated queries may require manual validation, particularly when dealing with complex log formats or custom data sources. Sometimes, query results may need refinement to avoid false positives or may miss some relevant events. Improving query accuracy, field mapping, and consistency across third-party observability would make the platform more reliable and reduce the need for manual troubleshooting.

I have been using SentinelOne Singularity AI SIEM for approximately two and a half years.

I find SentinelOne Singularity AI SIEM is generally stable for security monitoring and investigation. It is cloud-based and provides consistent access to security data across multiple sources. It can be affected by log ingestion delays, query performance issues, and issues with third-party data. For example, daily investigations involving large volumes of firewall logs depend on query performance and availability factors. Overall, the platform provides a reliable foundation for SOC operations. Continuous monitoring of data ingestion and integrations is essential to maintain consistent performance.

I find SentinelOne Singularity AI SIEM scalable in terms of adapting to my organization's evolving security events. Its cloud-based architecture allows us to expand security monitoring as the volume of endpoints, logs, and data sources increases without requiring significant changes to our underlying infrastructure. The platform's ability to integrate data from different security products also supports the onboarding of new log sources as the environment grows. For example, we can extend monitoring to additional firewalls, cloud, and on-premises environments while maintaining centralized visibility. Its AI-powered threat hunting and investigation capabilities further support scalability by helping analysts manage increasing volumes of security data more efficiently.

I find SentinelOne Singularity AI SIEM scalable and capable of supporting growing security monitoring requirements. The cloud-based architecture allows us to expand and integrate additional security data sources without changing underlying infrastructure. From stability to security data, it supports assisted threat hunting with increasing volumes more efficiently. For example, integrating firewall logs can be extended while maintaining centralized visibility. The platform has met our needs, but data migration capacity, integration complexity, and licensing costs must be considered.

My experience with SentinelOne customer support has been positive. The support team provides assistance with technical issues and product queries. Response times and resolution timelines can vary depending on the complexity. For example, issues involving log ingestion or third-party integrations may require additional investigation and coordination. Overall, customer support is helpful, but faster resolution of complex technical issues and more communication would be better.

I used Wazuh, which provided flexibility for log collections and a custom rule-based detection model. However, managing integrations, writing detection rules, and management required considerable manual effort. SentinelOne Singularity AI SIEM offers a more streamlined approach to AI-assisted threat hunting, natural language query assistance, and centralized data analysis. These capabilities can reduce the effort required for detection engineering and investigations. The main advantage is improved operational efficiency and simplified security analysis rather than the complete elimination of some technical tools or manual investigation.

I have experienced operational benefits from SentinelOne Singularity AI SIEM, which has reduced the time required for security investigations and detection rule creation. For example, investigating suspicious firewall activity traditionally involves manually filtering logs, but assisted investigations help simplify this to identify relevant events more quickly and spend less time on such tasks. Consolidating security data also reduces the need to switch between multiple tools during investigations. These improvements contribute to better utilization of SOC resources and potential cost savings through reduced manual effort. These are the direct forms and data of interest for return on investment, and the actual savings depend on investigation volume, analyst efficiency, and efficiency costs. I get every endpoint at a reduced cost, below the market value. The ROI may be better than I expected.

My experience in pricing and licensing has been primarily from an operational perspective. The platform's cloud-based data model simplifies infrastructure management and reduces the need for maintaining security system hardware. Pricing transparency and license flexibility are important considerations as the volume of security data and number of environments increase. Having clear visibility into data ingestion costs, licensing, and the impact of expanding integrations would help my organization plan its operations more efficiently.

I did not evaluate any other option because my company was already a partner of SentinelOne, and then we approached SentinelOne for AI SIEM, specifically SentinelOne Singularity AI SIEM. There were not any other options for me. Additionally, we trusted SentinelOne so much that we switched to AI SIEM without any hesitation.

I would rate SentinelOne Singularity AI SIEM an eight out of ten because it stands out in AI-powered threat hunting. The natural language query assistance is valuable for newer SOC analysts. Automated investigation, event correlation, and detection rule development are excellent. I have deducted two points because it could improve more on accurate AI-generated queries and easier conversion of queries into production rules, better third-party log parsing, and reduced false positives.

I find SentinelOne's governance and security approach valuable, particularly in its centralized security data management and AI system investigation capabilities. The platform provides visibility across multiple security data sources while allowing analysts to remain involved in investigation and response decisions. I would also like to see more granular controls over AI's interactions, clearer audit trails, and improved visibility into how AI reaches its conclusions. These enhancements would further strengthen trust, accountability, and governance with SentinelOne Singularity AI SIEM.

SentinelOne Singularity AI SIEM is deployed as a cloud-based SaaS solution in a public cloud. It allows us access to security monitoring, threat hunting, and investigation without maintaining the underlying SIEM infrastructure on premises. This simplifies deployment, infrastructure management, and provides scalability as security monitoring requirements grow.

I would recommend SentinelOne Singularity AI SIEM to those looking to improve their security monitoring. Its AI features can simplify complex queries, reduce manual investigation efforts, and provide better visibility across multiple security data sources. Organizations should evaluate their requirements, integration capabilities, and licensing costs before adoption. I would also recommend rule tuning and automation tuning. Overall, it is a valuable solution for SOC teams to improve their operational efficiency and strengthen their security posture.

SentinelOne Singularity AI SIEM is a tool that we use to support our clients. Our organization is a service-based organization, so we use SIEM to provide services to software-based clients. We are a partner with SentinelOne.

The best features of SentinelOne Singularity AI SIEM include its ability to give you a brief description of what the alert is about. When an alert is triggered with AI SIEM, we have a basic analysis of what the alert is about, and it will give you the understanding of what the alert is.

I especially value that analysis feature. If you get an alert in SentinelOne Singularity AI SIEM, we have an auto-investigate tab as well. If you click on that auto-investigate tab, it will correlate with all the products and data sources it has, and it will give you a deep analysis of what the alert is and what is happening, so everything is covered.

The real-time monitoring is pretty good. It correlates between all the different data sources that have been integrated with SentinelOne Singularity AI SIEM. It will correlate everything and give you a pretty good storyline of what the alert is about.

Overall, this affects my security posture positively because it improves it since it helps us in real-time monitoring, and it gives us automated investigation and also the auto-investigate tab, so it is pretty good.

My impression of the AI-driven threat detection capabilities is that it helps a little bit, but they need to tune it a bit because we are seeing too many false positives recently. Since we are a partner with SentinelOne, we are working along with them to tune those out.

I assess the efficiency of SentinelOne Singularity AI SIEM in improving our responses to sophisticated threats as not having improved a lot because, as I mentioned earlier, there are a few things that need improvement, including the false positive rate. Since we are seeing too many false positives, even if a true positive comes, it is harder for us to determine the difference between the false positive and true positive.

The effect on our SOC ability in reducing false positives has not been significant. We have opted for the possibility of doing some automation. Because of that automation, if SentinelOne Singularity AI SIEM already does the basic analysis, it will close out a few of the false positives, but not that much. I would say around ten to twenty percent of the alert volume is reduced.

The areas that need improvement with SentinelOne Singularity AI SIEM include faster responses. The tool is a bit slow since it is under development, so it is not that fast. They also need to improve on developing more use cases that will help determine the true positives.

I have not worked with any SIEM that is integrated with AI, but if I compare SentinelOne Singularity AI SIEM with Microsoft Sentinel, Sentinel has some use cases that are kind of true positives and all. Here, they need to improve on the tool functionality and faster responses.

I have been using SentinelOne Singularity AI SIEM for the past one and a half years.

I rate the stability of SentinelOne Singularity AI SIEM as pretty stable unless there is an upgrade. But if you run too many queries, it will be down.

The scalability of SentinelOne Singularity AI SIEM is pretty good; I would rate it around a nine.

I would rate the technical support around five.

I rate it five because even if you raise a case with SentinelOne support, you will not get that fast of a response. Even if you raise a P1 or P2, you have to engage back-end support in order to get a response from them. That has been a major drawback in the tool. Also, even if you get a response, it will be a generic response.

The alert volume has been reduced by around ten to twenty percent.

The pricing for SentinelOne Singularity AI SIEM is cheap when compared with other tools. I do not know the exact prices, but I heard it is cheap when compared with the other tools in the market.

In my organization, approximately eighty people work with SentinelOne Singularity AI SIEM.

Our clients vary in size; we have small businesses, medium enterprises, and large enterprises as well.

SentinelOne Singularity AI SIEM does require maintenance in that we manage the integration and everything, but the tool UI and everything is updated by the SentinelOne team itself. We do not upgrade anything.

Doing updates for SentinelOne Singularity AI SIEM is easy.

I evaluate the efficiency in investigating alerts and responding to various incidents as pretty good; they have a pretty good collection of events. You will have all the events that you need to do an investigation, and I would say it is pretty good. Once you start working with the tool, you will have pretty good responses in the event search to investigate.

We are using the automated workflow feature in order to reduce the number of false positives. With that, benign threats and all will be there, so we are just closing them out. It is reducing the volume of alerts for now.

The advice I would give others looking to implement SentinelOne Singularity AI SIEM is that it has its pros and cons. If you are looking for a decent tool for investigation, it is good. But if you are a large enterprise and if you have loads of logs that are being ingested, I would say just think about it because we are having issues while handling large clients and pulling a larger number of logs. I would rate this product an eight out of ten.