SentinelOne Singularity AI SIEM, Hyperautomation, Purple AI & Observo AI

My main use case for SentinelOne Singularity AI SIEM is centralized log management, threat detection and correlation for incident investigation, automated response, cloud security monitoring, and endpoint plus SIM correlations.

My primary use case for SentinelOne Singularity AI SIEM is centralized security monitoring and incident investigation. I ingest logs from Microsoft Entra ID, Active Directory, Microsoft 365, firewall, VPNs, and SentinelOne EDR into the AI SIEM. Instead of checking each platform individually, I use SIEM to correlate events, identify suspicious activity, and investigate incidents from a single console.

The best features SentinelOne Singularity AI SIEM offers include centralized log management, AI-powered threat detection, Purple AI, AI Security Assistant, unified investigation timeline, and threat hunting. Hyper automation, fast search and investigation, cloud, and identity visibility are also standout features.

Out of those features, the centralized console is the one I find myself using the most, and it has made a big difference in my daily work.

SentinelOne Singularity AI SIEM has positively impacted my organization by improving visibility, reducing investigation time, and helping the security team respond to incidents faster.

Overall, SentinelOne Singularity AI SIEM is a strong platform, but there are a few areas where it could be improved. One area is customization. While it provides many built-in decorations and dashboards, creating highly customized decoration rules and reports can sometimes require additional efforts. Another area is third-party integrations. Although it integrates with many security products, expanding native integration and simplifying onboarding for less common vendors would make deployment easier.

From a usability perspective, I think the platform could make advanced investigation more intuitive. New analysts can face a learning curve when building complex searches, custom detection rules, or dashboards. Improving the user experience with more guided workflow templates and contextual recommendations would help teams become productive more quickly.

I have been using SentinelOne Singularity AI SIEM for about one year.

In my experience, SentinelOne Singularity AI SIEM has been a stable platform. It has been reliable for day-to-day SOC operations, including log ingestion, real-time monitoring, threat detection, and incident investigation.

In my experience, SentinelOne Singularity AI SIEM is highly scalable. As my organization grows, it is able to ingest and analyze logs for additional cloud services, identity providers, and network devices without requiring major changes to my security operations. This makes it well-suited for organizations with hybrid or multi-cloud environments.

I would rate the scalability of SentinelOne Singularity AI SIEM very high. It is designed to handle growing log volumes and supports environments that include on-premises infrastructure, cloud services, endpoints, identity platforms, and network devices.

My experience with the support has been very responsive and knowledgeable, particularly for technical issues and troubleshooting. I would rate the customer support eight out of ten.

I previously used another SIM solution. The main reason for moving to SentinelOne was to improve centralized visibility, simplify security options, and take advantage of AI-driven event correlations. With the previous solution, investigation often required switching between multiple tools and manually correlating events.

Overall, my experience with pricing, setup cost, and licensing has been positive. While SentinelOne Singularity AI SIEM is an enterprise-grade platform and not the lowest cost option, I think the pricing is reasonable considering the capabilities it provides. Features such as centralized log management, AI-driven analytics, automated workflow, and integrated security options can reduce operational overhead and improve SOC efficiency, which helps justify the investment.

I have seen a positive return on investment primarily through operational efficiency rather than reducing headcount. The biggest measurable benefit has been the reduction in investigation time. Before using SentinelOne Singularity AI SIEM, investigating a moderately complex alert took around thirty to sixty minutes because analysts had to collect logs from multiple security tools. With centralized log management and AI-driven correlation, I can often understand the scope of an incident in about ten to fifteen minutes.

Overall, my experience with pricing, setup cost, and licensing has been positive. While SentinelOne Singularity AI SIEM is an enterprise-grade platform and not the lowest cost option, I think the pricing is reasonable considering the capabilities it provides. Features such as centralized log management, AI-driven analytics, automated workflow, and integrated security options can reduce operational overhead and improve SOC efficiency, which helps justify the investment.

I considered other enterprise SIEM platforms such as Sentinel, Splunk, Enterprise Security, IBM, and Google Security Operations. I evaluated them based on integration with my existing environment, AI-assisted threat detection, scalability, ease of investigation, automation capabilities, and total cost of ownership. SentinelOne stood out because of its strong integration between EDR and AI SIEM, centralized visibility, and AI-driven event correlations.

My advice would be to spend time planning the deployment and identifying the log resources that provide the most value. SentinelOne Singularity AI SIEM is most effective when it is integrated with key systems such as Entra ID, 365, VPN, and endpoints. I would rate this product eight out of ten overall.

SentinelOne Singularity AI SIEM serves as our centralized platform for security data across our environments, enabling real-time threat detection and accelerated incident response. I use it to collect and analyze logs from endpoints, cloud workloads, identity providers, firewalls, and SaaS applications.

We initially used SentinelOne Singularity AI SIEM to identify and investigate a potential account compromise. The platform correlated unusual login activities from our identity provider, multiple authentication attempts, and suspicious PowerShell execution on an endpoint. Rather than having analysts manually check logs from different tools, the AI SIEM automatically connected these events into a single incident. This allowed our SOC team to quickly determine that the credentials were compromised and isolate the affected endpoint.

Our primary use case focuses on improving SOC efficiency by centralizing security telemetry and using AI to correlate alerts from endpoints, cloud identity, and network sources. Instead of investigating isolated alerts, analysts receive prioritized incidents with the full attack timeline. This helps reduce alert fatigue, speed up investigations, and enable faster response to threats such as phishing, credential compromise, and lateral movement.

The best feature is that it collects and correlates logs, which is very helpful. We also use it for AI-powered investigations. The platform provides unified visibility, AI-driven alert correlations, threat hunting, automated response, and AI-driven data pipelines. These are the features I found most valuable.

We have been using the AI-driven alert correlation feature extensively. Without AI-driven alert correlation, an employee clicking on a phishing email could exploit our entire organization. The AI automatically recognizes that all of these events are connected because they involve the same user, endpoint, and timeframe. We use it when somebody receives a phishing email or clicks a link, credentials are used from an unusual location, PowerShell is launched, connections are made to a malicious server, and persistence attempts occur. The correlation feature helps us identify and correlate these attacks, determine where the attack started, and find the threat so we can fix it.

The platform brings together AI, automation, and unified visibility in a way that helps security teams work more efficiently. Rather than switching between multiple tools and manually correlating alerts, analysts can investigate incidents from a single console with AI-assisted context. Features such as automated alert correlation, threat hunting, and response workflows help reduce investigation time and improve overall SOC productivity.

One of the biggest positive impacts has been improved operational efficiency for the security team. By centralizing telemetries from multiple sources and using AI to correlate related alerts, we have reduced the time spent on manual investigation. Analysts can focus on higher priority incidents. We have also noticed faster incident detection and response, better visibility across endpoints, cloud, and identity environments, as well as improved collaboration because everyone works from the same incident view.

Overall, SentinelOne Singularity AI SIEM is a very strong platform, but there are a few areas where I would like to see improvements. The AI-generated investigations can occasionally require manual validation for complex incidents. Increasing the precision and explainability of AI recommendations would be valuable. I would also appreciate even broader out-of-the-box integrations with third-party security tools and more pre-built detections and response playbooks. Additionally, making dashboards and reporting even more customizable would help organizations tailor the platform to different teams and executive reporting needs.

SentinelOne Singularity AI SIEM is a very strong platform, so I do not have much to suggest for improvement. Those are the main areas I would highlight. Overall, the platform is quite mature, and the improvements I would like to see are more about enhancing usability than addressing major shortcomings. Continued investigation into AI accuracy and explainability, additional native integrations with third-party tools, richer pre-built automation playbooks, and more flexible dashboards and reporting would be beneficial.

I have been working in this field for one year.

I have experienced no issues with SentinelOne Singularity AI SIEM. It is the best product I have ever used. The platform has been very stable in my experience. I have worked with it, and it is very handy, easy to manage, and excellent with its AI-driven capabilities.

From what I have seen, I have not personally encountered scalability issues, so I cannot point to any specific challenge in a production environment. As with any enterprise SIEM, the main considerations tend to be planning data ingestion, tuning detection rules to minimize noise, and integrating new data sources as the environment expands. Those are common operational considerations rather than unique limitations of the platform.

I have not reached out to customer support yet and have not experienced it directly. However, I have heard from my organization that their customer support is very good. Several of my colleagues have spoken with customer support, and their experience was great.

I have only worked with SentinelOne Singularity AI SIEM because I have recently started working. I have seven to eight months of experience, so I have never used any different solution.

My advice would be to plan the deployment carefully, integrate all relevant security data sources, and invest time in tuning detection and automation. SentinelOne Singularity AI SIEM delivers the most value when AI supports experienced analysts by reducing manual work and improving investigation speed rather than operating without human oversight.

My organization is currently a partner of SentinelOne.

I cannot provide verified metrics because I was not directly involved in measuring ROI, so I would not want to speculate. My experience is that the value comes from improved analyst productivity, faster investigations, and reduced operational overhead rather than a specific percentage of cost savings.

We actually had a great experience with pricing, setup cost, and licensing. I was not directly involved in pricing or contract negotiation, so I cannot comment on exact licensing costs. My understanding is that SentinelOne offers enterprise licensing based on factors such as the product selected, deployment size, and required capabilities. The platform appears to provide good value because it consolidates multiple security functions into a single platform.

I was not directly involved in the product evaluation or selection process, so I cannot accurately state which vendors were formally evaluated. In general, organizations looking at AI-powered SIEM solutions consider options such as Microsoft Sentinel, Google Security Operations, IBM, Falcon Next-Gen SIEM, and Microsoft Defender. However, I have not worked on those solutions, so I only have knowledge of SentinelOne Singularity AI SIEM.

AI-driven analytics can reduce false positives by providing better context and correlating related alerts into meaningful incidents. This helps analysts spend less time investigating false activity and more time responding to genuine threats.

My impression is that the AI-driven threat detection capabilities are one of the platform's key strengths. Overall, I have a positive impression. The AI-driven threat detection helps identify suspicious behavior, correlate related events into meaningful insights, and prioritize higher-risk threats. This enables analysts to investigate and respond more quickly while reducing alert fatigue. Human validation is still important, but the AI provides valuable decision support.

From my perspective, SentinelOne Singularity AI SIEM appears very suited for organizations with growing data volumes and increasingly complex IT environments. The visibility to ingest and correlate telemetry from endpoints, cloud workloads, identity systems, and third-party security tools provides a centralized view as the environment expands. Real-time monitoring impacts our threat identification process significantly.

Based on its capability, SentinelOne Singularity AI SIEM can improve SOC efficiency by correlating alerts, summarizing incidents, and helping analysts prioritize genuine threats. This reduces manual investigation and enables faster incident response while analysts still validate the AI's recommendations for critical decisions.

I think SentinelOne has taken a strong approach to AI governance and security. The platform uses AI to assist analysts with tasks such as alert correlation, investigations, and incident summarization while still allowing human analysts to validate findings before taking actions. From a governance perspective, having role-based access control, audit logs, and centralized visibility helps organizations maintain oversight. It is important to have clear governance policies, regularly review AI-generated recommendations, and ensure automated response workflows are appropriately validated.

Overall, I would rate the accuracy and reliability of the AI capabilities as good. The AI is effective at correlating related alerts, summarizing incidents, and helping analysts prioritize investigations, which can significantly reduce manual effort. However, AI outputs should not be treated as infallible, and for higher impact security decisions, it is still important for analysts to validate the AI findings and recommendations. I would rate this review as an eight out of ten overall.

We have dealt with SentinelOne Endpoint, and at some point, we also used SentinelOne Singularity AI SIEM, which was introduced somewhere last year. I went on training in South Africa, where there were many questions discussing having one platform that allows control over all endpoints with visibility, which eliminates the need for separate systems. The challenge with SentinelOne Singularity AI SIEM is having an ingester to integrate with it at the syslog level. For some customers, we needed an ingester to integrate with the network devices before we could see them. For the endpoint side, everything was acceptable; we were able to do remediation, ransomware rollback, and everything operates autonomously, so no manual intervention is necessary. In terms of group level, you can assign policies to specific devices in specific environments. Additionally, there was a new introduction to cloud-native apps for cloud security, enabling integration of AWS and Google Suite apps, including Azure platforms, providing visibility, especially for AWS, where we can monitor all Kubernetes clusters and pods, allowing for remediation as vulnerabilities are identified.

The AI features of SentinelOne Singularity AI SIEM are absolutely perfect. There are not any issues because there is a game that you play with SentinelOne. This game allows me to drive a proof of concept for customers. When I play the game, SentinelOne provides a tool called Purple AI, which allows for simple queries just like ChatGPT. This means you do not need an expert to understand what is happening around your endpoints and identify threats. I can simply write, 'What happened to my Windows endpoint in the last seventy-two hours?' and it provides all reports and logs. This functionality makes it accessible even for CEOs and decision-makers to understand their environment better, making it an excellent feature for SOC, giving visibility and clarity.

I did use the automated workflow feature for a client. The automation allows for configuring all integration with endpoints, as well as SentinelOne Singularity AI SIEM. Unfortunately, I was not happy with SentinelOne Singularity AI SIEM because it is not mature yet. When comparing SentinelOne Singularity AI SIEM to platforms like Elasticsearch or Exabeam, or even QRadar, they are more matured. SentinelOne Singularity AI SIEM is designed to provide an affordable platform integrated with endpoints, eliminating the need for separate SIEM deployments. However, the integration of a log ingester in the cloud makes deployment cumbersome and requires an expert or native system integrator for setup.

SentinelOne Singularity AI SIEM should be separated from the overall platform. If the intention is to make it a complete solution and enable SIEM features, separating it would yield better results. You get a lot of noise when it is combined; separating it would mean clearly identifying logs from the EDR or SDR platform to SentinelOne Singularity AI SIEM. This would help in minimizing confusion and panic for customers facing numerous logs and potential false positives. A separate SIEM would allow clearer visibility, and there is a need for an on-premise option, particularly for organizations with data sovereignty concerns. Many institutions prefer to keep their data on-premise due to regulations, so adding an appliance that firms can integrate into their data centers would be valuable. If larger organizations need a SIEM solution, they will likely turn to QRadar or FortiSIEM instead.

I already have experience with SentinelOne because I have been with SentinelOne for the past five years.

In rating the technical support for SentinelOne, it depends on whether we are discussing EDR or SentinelOne Singularity AI SIEM. I would not rate the entire company uniformly. For the EDR, I might rate it around eight out of ten; for SentinelOne Singularity AI SIEM, I would give it five out of ten or two out of five.

Regarding pricing, the pricing of SentinelOne is quite favorable when compared to CrowdStrike. I appreciate the MSSP distribution model. For instance, if I purchase SentinelOne from Exclusive Networks, which I believe is known to you, I can provide it to individuals, allowing them to have SentinelOne installed on their laptops while maintaining the ability to control policies and monitor attacks. The MSSP pricing is negotiable, around thirty-three dollars per endpoint annually. For the reseller level, if support is needed, contacting SentinelOne directly allows me to open a case and access assistance from their engineers, which may cost around fifty dollars per endpoint. Comparatively, SentinelOne is more affordable than CrowdStrike. SentinelOne Singularity AI SIEM pricing also depends on the number of devices onboarded, including switches and firewalls, which all contribute to lowering costs. However, selling a complete cloud solution can be challenging in West Africa due to data sovereignty concerns.

The need for improvement mainly revolves around focus areas. If SentinelOne only concentrates on developed countries, my experience in West Africa suggests disparities. SentinelOne needs to consider implementing an on-premise configuration or introducing a hybrid model. A staging server that sits on-premise allows for better data sovereignty while still using cloud services. If all logs are sent to the SentinelOne cloud, it poses challenges for customers without AWS capabilities.

I would rate SentinelOne Singularity AI SIEM overall at five out of ten. It is not suited for enterprises but works for startups or any environment that relies on cloud resources. My overall review rating for SentinelOne is five out of ten.

The primary use cases for SentinelOne Singularity AI SIEM are that we are using it as a replacement for Secureworks. We migrated to and switched to SentinelOne.

SentinelOne Singularity AI SIEM has positively affected my SOC's efficiency in investigating alerts and responding to incidents. Most of the functionality between Secureworks and SentinelOne Singularity AI SIEM is comparable, as both work in the same space.

We primarily switched to SentinelOne Singularity AI SIEM because of its native integration capabilities. We did not need to integrate with other tools because Secureworks was working with SentinelOne agents and they stopped that support. We were required to install a separate XDR client because Secureworks recently joined with Sophos and now wants us to install Sophos endpoint agents on our endpoints. That was a significant undertaking for us. From a financial perspective, SentinelOne was much more suitable for our organization. They offered us a very competitive proposal because we are among the top five SentinelOne customers in Saudi Arabia, and we are actually the first customer in Saudi Arabia. The POC was successful, so we proceeded with the implementation.

The most valuable aspect of SentinelOne Singularity AI SIEM is not actually the features themselves, but rather the integration capabilities with SentinelOne EDR. Previously, we were integrated with Secureworks, but now we are directly integrating with SentinelOne itself for AI SIEM, EDR, and NDR services. We have consolidated everything into one platform.

My impression of the AI-driven threat detection capabilities of SentinelOne Singularity AI SIEM is that it encompasses more than just AI-driven threat detection. We are integrating it with many devices and forwarding logs from multiple sources to SentinelOne Singularity AI SIEM. We are ingesting logs from Fortinet, other firewalls, other security products, and even from the cloud including Microsoft Office 365 and other security products.

SentinelOne Singularity AI SIEM has also been very stable.

There is room for improvement when it comes to the technical support quality and expertise of SentinelOne. Sometimes, the technical support team does not know how to resolve certain issues and takes time to respond, often requiring follow-up interactions within 24 hours.

SentinelOne Singularity AI SIEM can be improved in terms of support capabilities. Some logs from the server side need to be ingested. Secureworks was integrating with domain controllers and other systems, but SentinelOne still has some gaps. Some vendors cannot be integrated directly. For example, we are using Cisco Umbrella for DNS security, and we have to integrate it through an Amazon S3 bucket where we dump the logs and SentinelOne reads them from that location. For some Microsoft integrations, we must enable certain storage components and pay Microsoft directly to retrieve logs. There is no direct integration, so we must access the logs through that workaround. Previously with Secureworks, we had direct integration with Microsoft. Direct integration with Microsoft is not available now. SentinelOne needs to work on many product integrations to enable direct connectivity.

We implemented SentinelOne Singularity AI SIEM in February, and we have been using it for almost eight months now.

SentinelOne Singularity AI SIEM has been very stable.

SentinelOne Singularity AI SIEM's scalability in adapting to our organization's growing data and complex IT structures is flexible. We have not faced any scalability issues so far. Perhaps after one or two years we can discuss challenges we may have encountered, but as of now we have not faced anything related to scalability.

I would rate the technical support from SentinelOne as 8.5 out of ten.

We were using Secureworks before migrating to SentinelOne Singularity AI SIEM. My impression of the AI-driven threat detection capabilities is that SentinelOne Singularity AI SIEM encompasses more than just AI-driven threat detection. We are integrating it with many devices and forwarding logs from multiple sources to SentinelOne Singularity AI SIEM. We are ingesting logs from Fortinet, other firewalls, other security products, and even from the cloud including Microsoft Office 365 and other security products.

SentinelOne Singularity AI SIEM is deployed using a cloud-based SaaS model.

SentinelOne Singularity AI SIEM is used in our company.

When we took the service from SentinelOne, they provided an onboarding process with a dedicated engineer who helped us with all aspects of the implementation. A dedicated engineer from SentinelOne regularly contacts us, assists with configuration, and works with us on implementation details.

I find SentinelOne's pricing to be reasonable and competitive. We have taken SentinelOne Singularity AI SIEM along with the MDR service and also included ITDR (Identity Detection and Response) and EDR. They bundled all these services together and provided them to us as a single package.

SentinelOne offers a SOC service that handles our SOC operations. My impression of the AI-driven threat detection capabilities of SentinelOne Singularity AI SIEM is that it encompasses more than just AI-driven threat detection. We are integrating it with many devices and forwarding logs from multiple sources to SentinelOne Singularity AI SIEM. We are ingesting logs from Fortinet, other firewalls, other security products, and even from the cloud including Microsoft Office 365 and other security products.

We have used the automated workflow feature of SentinelOne Singularity AI SIEM and are still working on it. We started implementing automated workflows almost three months ago. The automated configuration is not a one-time setup, as we are continuously making changes and modifications over time.

I assess the overall security posture of our organization after implementing SentinelOne Singularity AI SIEM as significantly improved. We have developed a security posture that has definitely reached the benchmark. Previously, we were using Secureworks XDR, which is also a very good solution. We ran both solutions in parallel and discovered that Secureworks had almost a ten minute gap in identifying issues compared to SentinelOne, with a five to eight minute difference between the two platforms. The issue with Secureworks XDR is that it was not taking action because their playbooks were not efficient enough, partially because they were integrating with SentinelOne. In contrast, SentinelOne has local integration, so it immediately takes action and responds on the endpoint with automation. If any threat or suspicious activity is detected on any endpoint or server, SentinelOne immediately takes action at the same time. We have definitely increased our security posture.

I would rate SentinelOne Singularity AI SIEM overall as 8.5 out of ten. There are still certain things we are evaluating, so we maintain the rating of 8.5. I am basing this rating on three main factors: the quality of support, the frequency and quality of updates, and the integration and update capabilities. In terms of threat detection, response, and log collection, SentinelOne Singularity AI SIEM is excellent. We do not have any issues with those areas.

SentinelOne Singularity AI SIEM's AI-driven analytics have positively affected our SOC's ability to reduce false positives. We initially encountered false positives, but after configuration and adjustment, it performed much better for us. We now experience very low rates of false positives.

Consolidating multiple tools into SentinelOne Singularity AI SIEM has positively impacted our SOC's operational costs. We now manage our EDR, MDR, view logs, and handle automation all from one consolidated console from SentinelOne Singularity AI SIEM.

The consolidation has also reduced our SOC's operational costs and staffing needs. We are also taking SOC services from SentinelOne itself. SentinelOne has a dedicated SOC service that handles our SOC operations.

SentinelOne Singularity AI SIEM's scalability in adapting to our organization's growing data and complex IT structures is flexible. We have not faced any scalability issues so far. Perhaps after one or two years we can discuss challenges we may have encountered, but as of now we have not faced anything related to scalability.

We currently have five administrators managing this product, each with different roles and responsibilities. Within our structure, we have multiple entities, and we can create entity-wise administrators, which works very well for us.

More than 2,500 users in our company are using this product.

One issue we are facing is that SentinelOne's support team, as part of Amazon, works on updates on Sundays at the weekend. However, Sunday is the first working day for the Middle East region, particularly in Saudi Arabia. We have requested them to address tenant-related issues during our working hours. They are considering this request, and once Amazon establishes operations in Saudi Arabia, our tenant will be shifted to the kingdom and this issue will be resolved.

I would also like to mention the maintenance window for upgrades, which is an area that could be improved. My overall rating for SentinelOne Singularity AI SIEM is 8.5 out of ten.

We discuss with customers whether they want to go on a cloud or on-premises for the usual use cases of SentinelOne Singularity AI SIEM that I work with mostly. If a customer has a SentinelOne EDR, the EPS we do not count. The rest of the things we can integrate on a cloud.

Correlation, alerting, reporting, and helping with the AI-based alerts generated by the AI are the usual use cases. The parsing is already built into SentinelOne Singularity AI SIEM.

Detect undetected is a method for SentinelOne Singularity AI SIEM that I have found the most valuable so far. It can improve the true and reduce the false alerts and give a more granular report with a custom dashboard. Whatever the customer wants to see and however the customer wants to see it on the cloud-based SIEM. We can have the S3 bucket where we can manage the data retention from the customer side.

The automated workflow feature of SentinelOne Singularity AI SIEM is very good, which is not in the traditional SIEM. The next-gen is helping customers create multiple workflows, either automatically taking action in a SOAR kind of concept, and then you can create a playbook and multiple runbooks. The beauty of the integration is that it integrates very smoothly with third-party tools, so we do not need to think about the parsers, coding, depending on the codes, or the software developers. That is a good addition to SentinelOne Singularity AI SIEM.

I would want the false positive ratio to be lower and would want to improve that aspect so the true will be more, and the false will be lesser.

Other than false positives, the true will be increased and more focus should be on the OT security operations center. Now everything is on the cloud. Whenever OT security comes into the picture, the customers do not allow us to integrate their OT devices on a cloud. It should be available on-premises because the OT SIEM market, in the India market for instance, is something around a four to eight billion dollar market. Due to limitations on the cloud, we will not be able to configure with the OT SOC or the OT AI SOC.

I want SentinelOne to offer more on-premises integrations to focus on the OT SOC. It is one market which is an untouched market by the SentinelOne team. They have a very good SIEM, but it should be the target industry, the automobile, automotive, and then definitely IT is one of them. Everything is there with IT. The very good controls, integration, no parser requirements. But OT should also be the focus of the SentinelOne team.

I have been working with SentinelOne Singularity AI SIEM for about one and a half years.

I can rate SentinelOne Singularity AI SIEM a four out of five in terms of scalability in adapting to customer growing data and complex IT structures.

Four is because the product is beautiful, and the one reason why it is not a five out of five is because the capability of the SentinelOne pieces is not up to the mark.

It is scalable, and we can increase the compute size. It can scale. There are no challenges. It is good because it is on a cloud, so there is no problem with the scalability.

There are no challenges in handling growing data and complex IT structures because we create a log collector that is on AI. We build the VPN tunnel from all the locations. We pull in the logs. It is a pull and push mechanism. Things work fine. There is nothing critical these days.

The technical support of SentinelOne Singularity AI SIEM is very good, and we are getting support from them. Sometimes, whenever customization is required, they ask for PS. The team sometimes asks for professional services, which the customer does not agree to pay for.

Based on my experience with the technical support of SentinelOne Singularity AI SIEM, I would rate them a ten.

For one year they have been safely managing because they have replaced some of the competition with SentinelOne Singularity AI SIEM, including CrowdStrike.

We do participate in the initial setup of SentinelOne Singularity AI SIEM.

The usual setup process involves the log collectors and the cloud-based device. We create the VPN tunnel from the customer locations, and then we analyze the logs, create the alert, identify the incident, exposure management, and event search. It also works as a data lake, which is very good in SentinelOne Singularity AI SIEM. We have very good vulnerability management, which shows the beauty of the product.

There are no challenges with the initial setup because we have done multiple successful deployments.

The effect of SentinelOne Singularity AI SIEM on our customers' SOC efficiency in investigating alerts and responding to incidents is significant. We align our people, including L1, L2, and L3 engineers, for post-implementation, migration, reporting, alerting, correlations, and the behavior-based SIEM alerts. We align the people and discuss the ROI with the customers on SentinelOne Singularity AI SIEM.

For one year they have been safely managing because they have replaced some of the competition with SentinelOne Singularity AI SIEM, including CrowdStrike.

We do the red teaming to assess the real-time monitoring feature of SentinelOne Singularity AI SIEM. We check whether the real-time alerts are coming or not from the SIEM.

For one year they have been safely managing because they have replaced some of the competition with SentinelOne Singularity AI SIEM, including CrowdStrike.

Correlation, alerting, reporting, and helping with the AI-based alerts generated by the AI are the usual use cases. The parsing is already built into SentinelOne Singularity AI SIEM.

There is no challenge with operations because there are very good training portals where the people learn and perform the operation actively, and there is super training available on the SentinelOne portal through the SentinelOne Training University.

I provide this review with an overall rating of ten out of ten.

For us, the use case is primarily to analyze security events that are coming in and also events that are kept over a period of time, to track and use it for investigation and maybe analysis, sometimes even forensics.

SentinelOne Singularity AI SIEM improves my response time to sophisticated threats in two ways: it helps me to identify which ones I need to act on, which means I am not wasting time on the things I do not need to worry about or can be a lower priority. In that respect, it helps me to prioritize and act on what needs to be acted on first, so it brings it to the surface faster.

Regarding AI-driven threat detection capabilities, I have a positive impression; when it is working very well, I do not really know if it is working, but when it does not work and if I have been hit by something, then I know it did not work. My SOC team seems to be utilizing it fully, and we have been kept secure and without any breach, which I think is probably the only proof we can give. The number of events and logs that it detects is numerous and very high, so it is doing its job. Fingers crossed, we do not have anything to report where we find that we have been broken into.

SentinelOne Singularity AI SIEM's AI-powered analytics does affect our SOC's ability to reduce false positives; that is one of the biggest advantages because the manpower that I have is limited. The tool should be able to do a lot more of the first-level analysis, and what is flagged up for the man in the middle or the man to act on should be things that really need validation, meaning it has been correlated properly and brought up for visibility and action. In this manner, it is actually helping us to protect our security operations very effectively.

It does affect my efficiency in investigating alerts and responding to incidents; we have gone to the point of using SentinelOne Singularity AI SIEM now, and our SOC is mainly dependent on SentinelOne Singularity AI SIEM. That is becoming the foundation on which all these activities and tasks are being run, and when it is all coming together, we are seeing that it is far more effective. I hope it stays that way.

I would not say there is anything that could be better in SentinelOne Singularity AI SIEM; I think we have seen something unique in the product. This product has the potential to add more SOC functionality on top of its SIEM, which can automate a few more things because I have the information there. I need to do what I would call security agents or agentic AI to be built on top; it can take care of a lot more analysis and actions. Maybe licensing cost can also be looked at and reduced.

We are still to see the automated feature work a little bit more; we are not really using it to the full extent.

With SentinelOne Singularity AI SIEM, I have been dealing with this product for under a year, at seven or eight months now.

There has been no issue with stability; it was perfectly fine.

Scaling out, we did not face an issue because we are always looking to see where we are deploying it and what the coverage is, so no challenges are seen there.

I am happy with the technical team of SentinelOne Singularity AI SIEM; they are pretty good. I would rate the technical support as eight to nine.

The deployment process was straightforward; we did not face any challenges in that.

It was largely done by my in-house team; I have a fairly competent in-house team. We did have a partner through whom we procured the product, so they were available on standby, but even more than the partner, I think the SentinelOne Singularity AI SIEM technical team was also available to us. Their guidance was good enough.

In terms of ROI, it is hard to justify; the good thing is if there is a cost to an incident, I think we are protected. If we are not having any incidents, then it is doing its job, but I am not able to convince people about it. Overall, my perspective should be about my security budget in this space, how it benchmarks, and from that perspective, how the metrics are showing. If I am spending more compared to my peers in this space and the value that I am getting is the same as what they are getting, then I am probably overpaying. However, if I am in the middle of the park kind of range, then it is probably optimally priced. At the moment, I feel the pricing is a little bit on the higher side, but the tool is positioned in a place where risk is very high, and we do not want to take chances, so we are prepared to pay the premium.

We have looked at other XDR products, but the strength of SentinelOne Singularity AI SIEM's SIEM, their logs, the event log capture part, which can also take in logs from other non-SentinelOne entities, stands out as quite unique. The automation that is possible on the AI platform adds to that as well. When your footprint is all on SentinelOne Singularity AI SIEM in terms of VDR, then adding to that the same from the same suite is going to be helpful. At the moment, I see them as leading in their spaces.

I assess the overall security posture of the company after implementation as positive; I see a big impact on that. I would rate this review as an overall eight.