SentinelOne Singularity Platform

Our use case primarily involves using SentinelOne Singularity Complete  for other clients as an EDR to monitor endpoint-related alerts, including malware and any malicious files, ransomware files, and any attack on endpoints such as servers or laptops. We use it as an EDR.

SentinelOne Singularity Complete  has behavior-based AI that detects alerts that are not predefined without relying on predefined rules. For example, it detects zero-day attacks or any behavioral changes in the baseline of the user, or any suspicious anomalies through AI-based threat detection only.

In terms of SentinelOne Singularity Complete's ability to ingest and correlate across our security solutions, when using this AI SIEM , it provides any incident in a unified view only. It correlates and gives the information in one view rather than requiring access to other data sources. It connects the dots and gives a complete, correlated incident.

With SentinelOne Singularity Complete integrated with AI, false-positive alerts have been reduced significantly. I can say that 50% of false-positive alerts have been reduced, and we mostly get true positive alerts. I cannot say 100%, but the false-positive to true-positive ratio has been reduced by 50%.

We do not currently use the Ranger functionality option as it has not been enabled by our organization.

SentinelOne Singularity Complete itself is somewhat laggy and loads slowly at times. Sometimes when there are alerts in the dashboard, we cannot see them and it shows zero alerts. In this case, we have to log out and log in again and refresh it before we can see the alerts. We also experience some flickering issues. The UI needs significant improvement. In this case, I would rate it around 6.5 to seven on stability and performance.

I have been using SentinelOne Singularity Complete for one year and two months.

The mean time to detect with SentinelOne Singularity Complete depends on AI automation as well. Mean time to detect does not process for more than three or four seconds. We get real-time alerts that arrive as incidents occur. The product is performing very well in terms of MTDD and MTTR.

Scalability for SentinelOne Singularity Complete is good. It works well with all the endpoints, even if there are large numbers of endpoints. For example, in an enterprise environment, it performs well. Proper configuration and policies need to be set, but overall it is effective. I would rate it around 8 out of 10 for scalability.

Technical support is good. I would rate it 8 out of 10 because there is a feature of AI support. If we require any help with documentation, we receive it immediately. With a single prompt, we receive help with documentation, and those documentations are very clear.

I have previously used CrowdStrike. I can say SentinelOne Singularity Complete is better than CrowdStrike because it is more AI-capable and integrated. It gives us alerts based on behavior using the AI. In this aspect, I have only used CrowdStrike as an EDR, and I can rate SentinelOne as better than CrowdStrike.

Deployment of SentinelOne Singularity Complete is easy. Installing agents is straightforward. We can do it using Active Directory and group policies. It is easy to install agents in endpoints.

In my company, SecureIntelli, we are a team of 15 members with two leads. The 15 members use SentinelOne Singularity Complete on an everyday basis to monitor for our clients.

SentinelOne Singularity Complete saves 50% time for me and my team in responding to alerts, and it has reduced response time by 50%.

SentinelOne Singularity Complete does not require any maintenance from our end. There is maintenance scheduled once a month from SentinelOne itself. We receive prior notification if there is any maintenance scheduled, but it does not take much time. The system will be offline for no more than five minutes. The security is still maintained during this time. If any alerts come or if anything is automatically remediated, it is taken care of in the backend.

I would recommend SentinelOne Singularity Complete over others. If they are using CrowdStrike, I can recommend SentinelOne Singularity Complete over that product. However, it requires some fine-tuning of policies and configuration. If that is done correctly, it works very well as an EDR.

With Purple AI , it summarizes the alerts. Without much manual intervention, we can determine if it is a true positive or not by seeing the Purple AI  alert summarization, what has been happening, what process activity is occurring, and what the user behavior is. It also provides recommendations on what to look for and what needs to be done to remediate the attack. This has helped us to respond to low and medium alerts very quickly, but it still requires manual intervention for high and critical alerts because Purple AI is not that accurate. Sometimes it gives more generic answers for any queries. In this way, we use Purple AI and it has benefited us.

I can say that with Purple AI, security is maintained in terms of data privacy. We cannot share it outside. I do not have much detail on this, but based on my experience, it is secure. There is no insecurity in using Purple AI and GenAI.

In terms of threat intelligence with Purple AI, it depends on the quality of the data that it is receiving. With AI analysis, it correlates with the threat intelligence databases, and if there are any matches, it shows whether the observable is a threat or malicious. It is very good in this aspect and it will be updating very frequently.

Purple AI summarizes the alerts in a very concise format. We can determine if it is a true positive or false positive by seeing a summary. Sometimes it is very precise. As it provides remediation recommendations as well, it is very helpful for us to respond in a shorter amount of time.

I am not sure about the financial aspect as I am in a technical department as an analyst and do not have much information on financial matters.

Overall, I would rate this product 8.5 out of 10.

I used SentinelOne Singularity Complete  for endpoint security, and we selected it because we were looking for an AI-powered cloud solution.

The best features of SentinelOne Singularity Complete  include a ransomware rollback feature that can be used on infected machines, which we have used before and appreciated. The deployment is fairly straightforward as well.

SentinelOne Singularity Complete's ability to ingest and correlate across our security solutions has not presented any problems. This capability provides a benefit when hunting for threats and leveraging the AI side of the platform.

Regarding alert reduction, I would not say the impact has been massive. One of the negatives we have found is that we receive quite a lot of false positives.

Overall, SentinelOne Singularity Complete saves me time, and I would say the time savings are approximately 10 to 15 percent.

The reporting in SentinelOne Singularity Complete could be improved as it is still somewhat clunky and lacks customization. Support response times could also be better.

I have been using SentinelOne Singularity Complete for approximately 18 months.

I would rate the stability of SentinelOne Singularity Complete as an eight out of ten.

I would rate the scalability of SentinelOne Singularity Complete as an eight out of ten.

I would rate the support of SentinelOne Singularity Complete overall as a six out of ten.

SentinelOne Singularity Complete was already in place when I joined.

The deployment of SentinelOne Singularity Complete was straightforward and easy. It took approximately one day to implement SentinelOne Singularity Complete, based on the number of clients we had.

Regarding pricing for SentinelOne Singularity Complete, on a scale where one is cheap and ten is expensive, I would rate it as an eight.

When comparing SentinelOne Singularity Complete with other vendors, we use it for client-specific purposes, while other clients may use Microsoft or similar solutions. I have noticed it works well.

SentinelOne Singularity Complete has not helped us consolidate any security tools that I am aware of.

We do not use the Ranger functionality in SentinelOne Singularity Complete as we use other solutions for that purpose.

Maintenance of SentinelOne Singularity Complete is straightforward to perform. Approximately 60 users use the solution, and all users are local. SentinelOne Singularity Complete requires some maintenance as part of our internal checks to ensure policies are up to date, which we perform on a weekly basis.

We do not use Purple AI .

My advice for others looking into purchasing SentinelOne Singularity Complete is that I would definitely recommend it. I would rate this review an eight out of ten overall.

The primary use cases for SentinelOne Singularity Complete  include endpoint security to detect, prevent, and respond to cyber threats in real-time using AI-based behavior analysis.

The second use case is that the SOC team will investigate incidents, automate response actions, and protect systems from malware and ransomware.

SentinelOne Singularity Complete  has helped me consolidate my security solutions, and there is some improvement overall. SentinelOne Singularity Complete is a good feature that requires skilled analysts and a proper plan for implementation. SentinelOne Singularity Complete is good for S1 analysts and is helpful for analysts with a simple GUI base.

SentinelOne Singularity Complete has helped reduce alerts for my organization. In my organization, we are an MSSP  and right now we manage 6,000 plus endpoints and provide services to 10 plus customers because we are a partner with SentinelOne, and our customers are buying from us while we are providing endpoint services. All customers from us are very happy because the biggest difference is that SentinelOne Singularity Complete gives us the support team and the TAC team. There is human intervention between us and the TAC team because SentinelOne Singularity Complete is a SaaS product. If we get a false positive alert or if we get stuck anywhere, the TAC team will resolve that. The biggest advantage is the support from the TAC team to us, which is very helpful. If there was no TAC team, I would not advise using SentinelOne Singularity Complete.

SentinelOne Singularity Complete has helped free up my staff for other projects and tasks. I will tell you how SentinelOne Singularity Complete helps our SOC team. First of all, we have implemented SOAR  technology, the Shuffle technology, which is open-source. Whenever an alert comes on SentinelOne Singularity Complete, we have integrated the Shuffle SOAR  technology. Automatically the alert will be killed and quarantined, and mitigating action will be taken from SentinelOne Singularity Complete. Before that, we had to raise the alert manually, but we integrated SOAR technology, and automatically the alert raises to the customer within one or two minutes. This reduces the false positive alerts. We give criteria for Sentinel  Shuffle: if the alert is triggered and the hash value for that file is bigger than five seconds, a secondary vendor will mark it suspicious or malicious, and we will raise the alert. Before implementing this, we had to manually check and explore and manually check deep visibility to determine where the alert came from or what scheduled task was generated. After implementing SentinelOne Singularity Complete with SOC as Shuffle SOAR, it is reducing the time significantly.

The best features from my perspective are that SentinelOne Singularity Complete includes EDR, XDR , and next-generation SIEM , and additionally, they have also added Purple AI . SentinelOne Singularity Complete is an automated tool with minimal interactions required. Everything works if we install the endpoint SentinelOne Singularity Complete agent on the endpoint. We don't require anything else because all the work will be done from the SentinelOne Singularity Complete agent that conducts real-time monitoring. If malware is detected, the agent will take care of its kill and quarantine and automatically send the alert to the dashboard.

If the agent is online or the desktop is online, it will connect to the dashboards, and we will get the alerts. That is the best feature. The second feature is the rollback feature for Windows, such as VSS rollback feature. If the endpoint is malware infected, we can restore our files and important data. These are the two best features I appreciate about SentinelOne Singularity Complete.

My impressions of SentinelOne Singularity Complete's ability to ingest and correlate across security solutions are that they can ingest logs from all over the device. For example, we have integrated the Shuffle open-source SOAR tool that ingests the logs from that Shuffle tool. Second, we have also integrated different firewalls and additionally, we have integrated the AWS  cloud. Ingestion is seamless and awesome from SentinelOne Singularity Complete.

Regarding the role Purple AI  plays in amplifying team knowledge, I use Purple AI for advisory and IOC purposes in my organization. I explore it for research purposes and find it very good and fast for sending advisories every week regarding vulnerabilities found. I don't use Purple AI much for other uses because I have limited exposure to it.

Regarding mean time to respond, the improvements I see with SentinelOne Singularity Complete are that genuine files also get alerts. We are getting false positives, but we are also getting genuine true positive alerts. The improvement will be deep visibility because as I am using Splunk as a SIEM , I compare deep visibility with Splunk, but deep visibility has limited access with only a 14-day policy to retain logs. The improvement will be in overall policy management. The third point will be the complexity of policies. If we want some endpoints to use only USB or if we need to block USB on some points, the policy management is very complex. The fourth point will be that Mac OS and Linux don't have the rollback policy; that policy is only for Windows. These four points are improvements if SentinelOne Singularity Complete can address them.

Data privacy and security when utilizing Purple AI is crucial for SentinelOne Singularity Complete, and SentinelOne Singularity Complete lacks in data security. Data security is very important in this world. In my organization, if we deploy SentinelOne Singularity Complete and we have integrated all the firewalls, all devices, and AWS  devices to SentinelOne Singularity Complete, logs will be forwarded to SentinelOne Singularity Complete through SentinelOne Singularity Complete. However, SentinelOne Singularity Complete doesn't have data security solutions such as Forcepoint DLP  or 48 layer; SentinelOne Singularity Complete doesn't have that DLP  solution. From the data security point of view, SentinelOne Singularity Complete is not good.

I have been working with SentinelOne Singularity Complete for 2.3 years.

In terms of stability and scalability, I heard the news that 25,000 plus endpoints can be installed in one go, so scalability is very good. Regarding stability, I haven't heard of any issues with SentinelOne Singularity Complete. Before two years ago, we heard about a blue screen issue with CrowdStrike, but I haven't heard of such issues with SentinelOne Singularity Complete. Stability is important because even if the agent disconnects from our console, it will still protect the desktop or laptop. There aren't many stability issues; the agent handles everything including upgrades.

Regarding the technical support and customer service teams, I rate them 10 out of 10 on a scale of 1 to 10. The TAC team, which is available 24/7, is the reason for this rating. We are now in India, but if we get stuck at midnight, any other TAC team will be in GMT or Europe or America, and they will assign our support engineer and suddenly schedule a call for us and resolve the issue. The TAC team plays a major role and is very important for us.

Regarding cost-effectiveness and ROI, I will say it is cost-effective. In India, before the installation of SentinelOne Singularity Complete, all our organizations used CrowdStrike, which is a competitor to SentinelOne Singularity Complete. After SentinelOne Singularity Complete came into the picture, the cost is more competitive, and the cost of SentinelOne Singularity Complete will be cheaper than CrowdStrike. I also have some exposure to CrowdStrike, so from a price perspective, I would prefer SentinelOne Singularity Complete if my organization has a limited budget for EDR or XDR  solutions.

Regarding the initial setup, I can say it is very easy to set up. We just need to create one tenant from my customer name and send and install the packets for Mac OS, Windows, and Linux servers. We take remote access, and within 5 to 10 minutes, one endpoint will be installed, although it takes some time to connect to the dashboard. The setup is very straightforward, and we have installed over 500 agents in one day. That is a very fast process we have accomplished.

For the deployment model, my organization has a tie-up with Amazon Web Services, AWS. We are using the cloud because of that tie-up with AWS.

Pricing-wise, it is very price-sensitive. My customers, enterprises, are buying from us. For small and medium enterprises, it is very costly. The pricing is approximately $7 to $10 per agent per month. My organization selling depends on the size of the endpoint we are dealing with, but the price is around $7 to $10 per agent per month. In terms of functionality compared to other EDR tools, it is the best price.

Regarding the key differences, both pros and cons of SentinelOne Singularity Complete compared to other technologies such as CrowdStrike or other EDR and NMI products, I have several pros and cons to discuss. The first pro is the fast response. The EDR will immediately get the malicious file, kill or quarantine it, and send the alert to our dashboard. The second is the rollback capability, which is a beautiful feature SentinelOne Singularity Complete gives us for Windows desktops and laptops. The third pro is the automation; 90% of actions will go through the agent. The agent will take all actions—kill, quarantine, alert—and everything is automated; we don't require anything else from our side.

However, cons would include the high false positive alerts; we get alerts for genuine files, and that creates noise, though we can whitelist it. Additionally, there is resource consumption; SentinelOne Singularity Complete uses more disk resources, which reduces the functionality of the desktop. The third con is that when we install the SentinelOne Singularity Complete agent, it takes time to reconnect to the dashboard due to network issues, and it can take 5 to 10 minutes for the endpoint to reflect.

Regarding SentinelOne Singularity Complete's Ranger functionality, I am an L1 analyst and I don't have much hands-on experience with Ranger, but I know that the Ranger is used for detecting rogue endpoints in our network. The Ranger functionality includes network discovery and control features. These two features are very important in Ranger because it ingests logs from network sources and captures the threat matrix including IOC. The most important functionality will be the Ranger's ability to detect rogue device detection. I cannot confirm that we can use Ranger to completely reduce the alerts because I don't have that heavy work as I am only an L1 analyst doing some basic admin tasks.

Additionally, right now we are implementing the next-generation SIEM of SentinelOne Singularity Complete, but this is in the initial phase. Regarding mean time to detect, SentinelOne Singularity Complete is immediately detecting the alerts and giving them to us on the dashboard. The problem is that when we install the agent on the desktop, it takes some time to show on the console. Otherwise, the agent is seamlessly running in the background; while the user is doing their job on desktops, the agent is doing its job greatly in the background.

For threat investigations, I don't have exposure because I am L1, and right now, I have L2. One of my seniors, a senior forensic analyst, uses Purple AI for threat investigation. I don't use Purple AI for threat investigation; I just use it for searching IOC.

For advice or recommendations for organizations considering SentinelOne Singularity Complete, I suggest that before implementation, first, train your SOC on how to handle alerts and investigate. When I started with SentinelOne Singularity Complete, my manager told me to sit with the MBA team and learn about it, which was confusing at first. Start with the pilot deployment instead of deploying thousands of endpoints at once; install a few endpoints to check the performance. Third, integrate SentinelOne Singularity Complete with all your SIEM tools or SOAR tools. We as customers integrate SentinelOne Singularity Complete with Shuffle SOAR and get benefits such as triggering alerts quickly, so implementation is crucial for SentinelOne Singularity Complete to be a powerful tool. Training SOC, proper configuration with skilled analysts, and a well-defined strategy are the key recommendations.

I rate this review 9 out of 10.