SentinelOne Singularity Platform

I work with SentinelOne Singularity Endpoint 's complete Singularity  Lake, which includes XDR , SIM, and everything integrated together.

I normally use SentinelOne Singularity Endpoint  for endpoint management, with the EDR setup to get data from my endpoints. As an MSSP , I receive alerts and incidents and work on securing endpoints.

For mean time to detect, we promise less than 15 minutes for critical activity as an MSSP . This obviously depends on how good the platform is, and we commit to less than two hours for resolution. Obviously, this depends on many factors beyond what you can do from the platform. As an MSSP, you need to be very mindful that there are company resources which make the final call on whether to block something or not, whether it's malicious but still needed for that particular environment. So I normally commit to 15 minutes for MTTD and less than two hours for MTTR.

I think over the last one and a half years they have been improving significantly. Prior to that, they were also a very good product. In the market, there are hardly three products I can name: SentinelOne, CrowdStrike, Defender for Endpoint, and a bit of Cortex , but I am not that impressed with that product. These are the three major products that are doing very well in terms of their active EDR engine where you get the storyline correct—what exactly has happened, the parent process, child process, command line arguments. You get everything in a single fetch. Now with Purple AI , I think you get everything. Even an L1 engineer does not need to do anything complex. They can just write in natural language and get the details they need.

I think SentinelOne Singularity Endpoint presents a very holistic picture of an alert. Their enrichment layer is quite great. Once you get an alert, you get the complete process around it: how the parent process has started, which child process it has enabled, what kind of command line arguments or modifications have been done, what kind of scheduled task has been created, what kind of network connection you have, and what kind of file activity has occurred. You get everything in a single view.

In terms of their XDR , the consolidation is quite good. They have their own SIM and everything as well. The consolidation point has improved a lot, and you get everything under a single umbrella. This makes life much easier for MSSPs like me to manage a particular customer.

I think a few things are the confidence level you get in an alert. You get that very straightforward, so it is easier and you do not need to worry about it. The second thing is the automation level within the platform. Your alerts lifecycle has false positives reduced dramatically. You get all these features, and they help a lot. Also, the biggest factor is when I am opening SentinelOne Singularity Endpoint and presenting to a customer, the question is whether I can get a complete story of what has happened. That is where the most fatigue happens. When an alert occurs, people have to reach out to multiple sources to find out what exactly has happened. I think the story completeness is quite great with SentinelOne Singularity Endpoint.

The biggest problem for any organization is their L1 layer. That is where you spend more time when you get an alert, determining what exactly happened and whether it should be converted to an incident or whether it is a false positive or a true positive. Now with Purple AI  and their LLM module, it is quite easier for the L1 engineers. The fatigue is quite low, and the alert to incident ratio has improved quite a bit. You know what is coming and what is not, and the L1 can add more value than they normally did before. Your load becomes easier on the L1 engineer, and obviously you can cut your costs there as well because one person can do more work. You do not need to teach any new language to manage SentinelOne Singularity Endpoint. As an MSSP, we can utilize the same L1 for multiple providers.

Since the enrichment layer is great and we get the data properly with deep visibility and the storyline is complete, the dashboarding is quite decent. You can make the call quite faster, and resolution time has decreased significantly.

The Purple AI features are notable. One of the most notable features is that you get a complete summarized alert. This works for someone who is not a great security L1 professional who has just joined from college or even for a more experienced professional who wants to see much data. You also get your AI verdict, indicating whether something is a true positive or false positive, so you get validation from AI. You get community verdict as well. If someone else has seen those alerts, you also see if there are similar alerts happening 1000 plus times, 10,000 plus times, or even just twice, or if it is only a standalone alert. Apart from that, you get a complete summary of what has happened, where it has happened, and why it has happened. You get complete details about what exactly has happened in a single click. So I think this makes life much easier for a respondent.

The two things that are top of my mind are Purple AI and the consolidation. What you get is detailed reporting and detailed RCA as well from them. The third thing is the storyline and complete visibility of what has happened and the complete flow of a particular attack vector. You get that very properly in SentinelOne Singularity Endpoint.

In terms of advantages, I think I will still use the AI visibility and the storyline. Most of the EDR providers use the same capabilities. Everyone has similar feature sets and everyone has been rated by ISG or other organizations. The end of the story that matters for every end customer or a provider like me is how well I can use it without getting too complicated. I have multiple stacks that I manage in my day-to-day, so how well their dashboard is, how well they are able to tell me the story around it, what exactly has happened, how exactly it happened, and how well they let me customize it matters. I think that is where SentinelOne Singularity Endpoint stands out. They are doing quite great there. At the same time, the Purple AI feature is much better. Imagine going for Copilot, which is a generic AI platform not specific to security. You may need to train it and work around it to get the exact responses you want. Apart from that, you pay for it, and you have to integrate it with your XDR or SentinelOne Singularity Endpoint, which creates lots of complications. When you get SentinelOne Singularity Endpoint, it is easier. Purple AI is already built into it, so you do not have to worry about it. You just buy it and can use it from day one.

I think they are doing pretty decent. The only thing is that once you are competing with someone like Microsoft and CrowdStrike, I think the investment should be slightly more in terms of a holistic view. Their threat feed is also limited. You get a very vast threat feed, but again it is not as mature as you get from a CrowdStrike or Microsoft stack. I think that is where they can look at it. Threat hunting is also something they do, so I think they can improve there as well. I think everyone is almost similar in that regard, so I think the rest of everything looks fine.

In terms of pricing, SentinelOne is slightly cheaper than CrowdStrike and Microsoft from what I have seen. Obviously, it is costlier than Sophos and a few other providers, but cheaper than those two. Deployment-wise I think it is there. I think the only thing is that Microsoft offers some free deployments to their customers with ECF funding and other options. I think that is something which Microsoft, being a bigger partner, has. Otherwise, I think they are doing good.

Regional availability is there, and I do know they are in most locations. In terms of compliance, there are some locations where I have seen them saying they still host on the US or EMEA region. I think the regional maturity is something they need to improve. I think otherwise, everything they are doing is quite good.

I have been using SentinelOne Singularity Endpoint for three to four years now.

I have not experienced any stability issues.

It is a very scalable environment. We have some large deployments on SentinelOne Singularity Endpoint, so the environment is very stable.

As a service provider, we manage most of the discussion in-house. Whenever we reach out to them, we get a very good response from them.

I think SentinelOne Singularity Endpoint is quite straightforward. They have been in the market, so the deployment and initial setup is quite easy. It is not a very tricky task and is very mature.

I think SentinelOne Singularity Endpoint is quite straightforward. They have been in the market, so the deployment and initial setup is quite easy. It is not a very tricky task and is very mature.

We purchased directly from SentinelOne.

As an architect, I do not work directly on ROI, but I think it is understood.

SentinelOne Singularity Endpoint sells on a SaaS model. For us, it does not matter whether it is AWS  or Azure , but we work with Azure , AWS , and everything.

SentinelOne Singularity Endpoint sells on a SaaS model. For us, it does not matter whether it is AWS or Azure, but we work with Azure, AWS, and everything.

The ask is always simple from a customer standpoint. What exactly do you want to achieve, and what exactly is your problem base? Take a call in terms of what makes your life easier rather than having a very fancy-looking product and still having to learn a new technology or hire a new set of people. I think that is the concern most companies have. So just go for a genuine product which does serve the purpose and at the same time gets you out of the situations. I would rate this product and experience a 9 out of 10.

I deploy SentinelOne Singularity Endpoint  agents on my client's servers and other endpoints to secure those systems.

SentinelOne Singularity Endpoint  offers the best features in the market at an affordable rate, providing a secure solution. The easy-to-understand user interface and Purple AI  are standout features.

Correlation is important, and I have correlated SentinelOne Singularity Endpoint with other types of devices and created several correlation use cases, making it feasible to create multiple correlating use cases.

It helps secure my infrastructure because it has a very fast response. The moment it detects a vulnerability or any threat malware on any file, it creates an alert and quarantines that file automatically, proving very reliable and saving significant time.

It does help reduce alerts. Although it generates many false positive alerts initially, when managed properly by deploying custom use cases, it detects only the required alerts, saving considerable time by marking only true positive alerts.

SentinelOne Singularity Endpoint is a fully AI-based model, negating manual tasks and allowing me to save considerable time to manage other priorities.

It saves a lot of time by detecting alerts in real-time and automatically quarantining malicious files.

It does help reduce my organization's mean time to detect.

I have used the Purple AI  feature that SentinelOne Singularity Endpoint provides quite extensively.

I have used Purple AI for identifying IOCs on my client infrastructure. Regarding data privacy, I do not rely on external LLMs like ChatGPT or Claude due to potential misuse of my valuable data. Purple AI, being SentinelOne Singularity Endpoint's in-house automated intelligence, is much more reliable from a data privacy perspective.

Purple AI has been very effective for my team, providing various features including the Copilot feature, which allows me to identify many non-present IOCs quickly and retrieve information in a very fast manner, saving considerable time.

It provides IOCs, which are a form of threat intelligence. By utilizing Purple AI, I am effectively preventing my clients from various forms of threats.

For Security Operations, it saves considerable time by performing quarantine automatically whenever a threat is detected.

The biggest benefit SentinelOne Singularity Endpoint brings to my particular customer is its fully autonomous capabilities, automating threat detection and auto-remediation rules, making it efficient.

I feel that the custom dashboard feature is absent in SentinelOne Singularity Endpoint, as I can only use a default dashboard. Additionally, for clients with large infrastructures of over a thousand endpoints, resource consumption can become high, which could be improved.

I have been using SentinelOne Singularity Endpoint for more than a year.

There have not been any issues regarding stability. It is fully scalable, allowing me to scale up or down as needed.

Regarding performance, I have faced some resource consumption issues for one particular client with a huge infrastructure. However, customer support resolves issues within the day, so I do not worry much about finding solutions.

The customer support team is very good at responding to queries on the same day. I would rate them ten out of ten in customer support.

I feel it is very easy to install SentinelOne Singularity Endpoint on any endpoint, as it just takes a few seconds to deploy and install the agent.

I am aware of the pricing module for SentinelOne Singularity Endpoint, although I am not the person handling it directly.

The cost for SentinelOne Singularity Endpoint depends on a per-device basis, charging around eight to ten dollars per month per device, which can be multiplied by the number of devices I want to deploy.

It is very cost-effective compared to other solutions, as SentinelOne Singularity Complete is not that expensive and has an aggressive price point.

I feel that in a week, for a particular client, five to seven alerts are generated. Out of those, if I estimate seven alerts, three would be suspicious, two false positives, and the remaining two or three would be true positives. I feel that twenty to twenty-five percent of alerts are false positives.

I would recommend that organizations choose SentinelOne Singularity Endpoint due to its impactfulness and low price, as I believe no other product offers what it does. My overall review rating for SentinelOne Singularity Endpoint is eight out of ten.

SentinelOne Singularity Endpoint  is used in my company as we are a client of Sentinel . The primary use cases are for endpoint security, policies, and other features.

The most valuable features I find in SentinelOne Singularity Endpoint  are the EDR, lateral movement feature, and machine learning feature, which I find impressive.

I am using the Ranger functionality in Singularity .

SentinelOne Singularity Endpoint does provide network and asset visibility, but in Singularity , you do not have the complete feature. If you want more EDR and want to know from where the attack happened and what it does, you have to purchase the EDR. When I purchased Sentinel , it had three products: SentinelOne Core, Control, and Complete. We are using Core. If you want full visibility on an EDR, there is one more add-on that you have to purchase. As a product, I think most of the features remain the same. It does not allow the machine to work if it finds any unknown activity; it immediately blocks the machine from the network and isolates it completely. Regardless of the location or where you are, if your machine is connected to the internet, you will get an alert that this machine has been isolated. It does not allow you to work at all.

There are certain things that need to be improved, such as the roll-up things because not every upgrade or update is useful. They have to do more work on the configuration side, which I believe they are already working on.

I would appreciate improvements in the patches. If I have Windows patches or application patches, it would be excellent if they could cover that on the same portal so I could go straight in and do it. It shows the vulnerability but does not provide the package to resolve that vulnerability. For example, if my Windows is outdated and Sentinel finds that there is an update that is not installed, there should be an option to install the Windows update from the portal itself.

The additional features I would appreciate in the future are already present in the Complete feature of SentinelOne Singularity Endpoint. Since I am using Core, whatever features are lacking in Core are already in Complete, so if customers want those features, they can upgrade their product.

I have been working with SentinelOne Singularity Endpoint for more than four years.

The response is excellent from them; the moment I submit a ticket, I can expect their response within 15 minutes, less than 15 minutes.

For technical support, I would rate them 9.5.

For security solutions, we are also using different types of products, but I have never done the correlation across our different solutions.

Regarding Purple AI , we have recently done that with ManageEngine.

We have not integrated SentinelOne Singularity Endpoint with third-party solutions.

My overall review rating for SentinelOne Singularity Endpoint is 9.5.