We are using SentinelOne Singularity Endpoint as we are currently working with it in our MSsp. We have been using SentinelOne Singularity Endpoint for threat detection in endpoints, and we have created multiple use cases to detect malware or any other suspicious activity that has been identified in any endpoint of our clients. We are using it for mitigating those threats.
What I appreciate about SentinelOne Singularity Endpoint is that it has a very fast response and a rollback capability, which I feel is a very big benefit for our customers in many ways where mostly everything is automated and the threat detection as well. The auto-remediation rules and setup are quite impressive compared to other CrowdStrike or any other EDR.
For correlation, SentinelOne Singularity Endpoint plays a very initial role when it comes to correlating with different devices. When we have to create use cases based on multiple rules, then creating a correlation between different use cases plays a very major role. We have deployed it for our client as well, but most of the time, we use our client's perspective while creating those correlation rules based on their recommendations and what they prefer to create. That is the time we create those customized correlated rules.
SentinelOne Singularity Endpoint has benefited us because it has a very fast response. It has helped our clients secure their endpoints so that no exploits can easily access their system. From a security perspective, it has helped our clients majorly.
Regarding mean time to respond, if I talk about improvement, it does need a few improvements, such as the limited deep visibility feature in SentinelOne Singularity Endpoint, policy management complexity, and also in the Mac OS and Linux feature. There are a few gaps in no VSS, so I could recommend several improvements that would be best to implement. One basic improvement is that in SentinelOne Singularity Endpoint, we cannot create a customized dashboard, which would have been better for visibility regarding managing threats and alerts.
Initially, I felt that it produced very high false positive alerts, which led to a resource consumption issue being a major setback for us, such as high CPU and disk utilization. Sometimes, SentinelOne Singularity Endpoint Complete tasks take time to reflect on some machines, possibly due to poor network connectivity. Additionally, we encounter problems with creating the star custom rule in SentinelOne Singularity Endpoint. Those are some cons or disadvantages I feel.
There are a few improvements, such as missing features that could be implemented appropriately. The limited deep visibility feature compared to other SIEM or XDR tools is limited, so that aspect could have been much better.
I have been using SentinelOne Singularity Endpoint for more than two years.
The main benefits that SentinelOne Singularity Endpoint brings to our table are stability and its ability to run continuously 24/7. The threat engine continuously works, and while we are scanning, the scanning feature in SentinelOne Singularity Endpoint allows us to scan any endpoints or servers. If any malicious threat is identified directly, I do not have to search for any breaches manually. I feel it is very stable.
SentinelOne Singularity Endpoint is scalable; we can scale up or scale down as per our requirement. If we want a higher number of endpoints to be deployed, we can easily scale up our requirements or scale down if there is no need for certain endpoints.
I feel the customer service and technical support of SentinelOne Singularity Endpoint are very good because whenever we need help, customer support gives us an immediate response. In day-to-day operations, we encounter scenarios where we have to connect with customer support for various questions from the client. Most of the time, we are not aware of how to resolve those questions, and SentinelOne Singularity Endpoint's customer support helps us significantly with a prompt response.
We are working with SentinelOne Singularity Endpoint only, as we have just started MDR services recently. We currently have SentinelOne Singularity Endpoint only.
I personally have not managed the initial setup; we have a different team for integration purposes. I feel it was very easy; we just have to install it on those laptops or endpoints, simply dropping the SentinelOne Singularity Endpoint agents.
I do not have proper knowledge of that, but I believe we do have a partnership.
Regarding return on investment, from a security perspective, SentinelOne Singularity Endpoint covers your endpoint security effectively. It is very cost-effective, and while we provide services to our customers, the ROI is very great because we are getting returns from what we earn by selling the product. In that perspective, I feel the ROI is very positive.
SentinelOne Singularity Endpoint Complete is not that expensive; they are very aggressive when it comes to price points compared to Microsoft and other competing solutions. SentinelOne Singularity Endpoint Complete is very competitive price-wise, with the cost depending on the device per device basis as per the client's needs. The full-fledged platform should be around seven to ten dollars per month, which is just a random estimate.
We are working with CrowdStrike as an alternate solution.
Comparing SentinelOne Singularity Endpoint with other technology, the basic thing that stands out is the user interface, which is very understandable and user-friendly. We do not have to rack our brains to think about how it works; it is very user-friendly and easier to manage admin tasks while whitelisting specific endpoints or users compared to other vendors.
SentinelOne Singularity Endpoint identifies threats in real-time. Anytime a client or user opens any malicious file and accesses it, if SentinelOne Singularity Endpoint marks it as a threat, then immediately the alert is raised. If the alert is a true positive based on the search engine of SentinelOne Singularity Endpoint, then it takes action on it and kills and quarantines the alert in real-time. It does reduce many manual efforts as the automation takes care of the major part itself.
For mean time to detect, it does identify the threat in real-time, so it does affect the overall time it takes to identify a threat.
Although it generates a lot of false positive alerts, if we create customized alerts for our clients, then it creates those alerts that are only useful for our clients. It depends on what the client is requiring from us. If we use the best capabilities of SentinelOne Singularity Endpoint, it does reduce false positive alerts.
SentinelOne Singularity Endpoint Complete is not that expensive; they are very aggressive when it comes to price points compared to Microsoft and other competing solutions. SentinelOne Singularity Endpoint Complete is very competitive price-wise, with the cost depending on the device per device basis as per the client's needs. The full-fledged platform should be around seven to ten dollars per month, which is just a random estimate.
Although I have very limited experience with Purple AI, we have used it while creating and managing security advisories for our clients to clear the gaps across the ongoing vulnerabilities in the market. While creating security advisories, Purple AI has greatly helped me in my day-to-day work.
We have used Purple AI. If we consider data privacy, Purple AI has an inbuilt feature in SentinelOne Singularity Endpoint that helps in data privacy because there are different LLMs in the market such as ChatGPT and Claude. While they are good as well, we cannot trust giving our personal data and sharing it with them. For Purple AI, we can rely much more on that because we know that our data is in good hands, making Purple AI much more reliable from a data privacy perspective.
I can use the pull-down menu in Purple AI to identify based on the IOCs present in the market. The retrieval time is very fast, so I frame certain queries on the dropdown menu and immediately see whether those telemetry matches present in my system. Using that feature, Purple AI has helped me a great deal.
Purple AI does help us find the IOCs, which makes it very useful. There are a few instances where we get confused while creating use cases, and during those times, Purple AI has helped us clear our process much more reliably.
SentinelOne Singularity Endpoint has benefited us because it has a very fast response. It has helped our clients secure their endpoints so that no exploits can easily access their system. From a security perspective, it has helped our clients majorly.
I am aware of the Ranger functionality; it is the network discovery control feature. However, in our environment, we have blocked the Ranger functionality currently, but I am a bit aware of what it does.
SentinelOne Singularity Endpoint has benefited us because it has a very fast response. It has helped our clients secure their endpoints so that no exploits can easily access their system. From a security perspective, it has helped our clients majorly.
While we provide services to our customers, the ROI is very great because we are getting returns from what we earn by selling the product. In that perspective, I feel the ROI is very positive.
Regarding data security, it is very important because in today's organizations, we have endpoints, networks, and applications everywhere on the internet. Data privacy is very important, and with SentinelOne Singularity Endpoint offering XDR solutions, Purple AI plays a major role.
On a scale of ten, I rate SentinelOne Singularity Endpoint an eight.
