SentinelOne Singularity Platform

My main purpose is to have protection for all my endpoint devices. I would like a unified solution which can reduce my operational cost and ensure my risk is less compared to other things. The primary use case is that I want to have my entire server and endpoint security solutions covered. I want to consolidate to ensure my maintenance and operational cost are streamlined in a better way.

This solution has really very good capabilities across the endpoint devices. It has real capabilities to ensure my endpoint device coverage across my organization. It can correlate my various threats so that it gives me clear detailed information across my entire enterprise landscape.

It is enabling my security solutions from my servers, Linux, Windows security, all at various touchpoints. It gives my all my laptop devices and everything the entire range of security purpose.

It prevents my vulnerable devices without any confirmation and without being compromised. The network and asset visibility has real visibility because it can see various types of devices connecting to my network.

It has reduced the MTTR significantly, at least 40 to 50 percent.

When coming into the picture with AI, I think it has to enhance the time to respond and can increase in that way. Time to respond is a delay that should be improved. Documentation also should be in a better way. As a customer, the price is also high for me.

It is not easy for engineers or for any new engineers, highly trained people would be better. For L2 engineers, it is not that easy for them.

I have already shared on LinkedIn the solutions what I am offering. I am using the endpoint security and all the protection platforms. I am using SentinelOne Singularity Endpoint Go and SentinelOne Singularity Endpoint Cloud also and also SentinelOne Singularity Endpoint Identity. It is almost two years that I have been a customer.

Stability is very good.

It is highly scalable.

In terms of my solution, the return on investment is better. I am able to get my staff reduced in that way. If the cost also can be decreased, then I will be happy.

I have already shared on LinkedIn the solutions what I am offering. I have shifted to another company which is called Wysely Digital. Microsoft Defender is another alternative that exists as an EDR.

I am currently using SentinelOne Singularity Endpoint Go, SentinelOne Singularity Endpoint Cloud, and SentinelOne Singularity Endpoint Identity. It has eliminated all false positives that are generated. This has helped my staff to focus on other purposes. The cost price point at one hundred dollars or higher is a consideration. I would rate this solution an eight out of ten. It is on-premises deployment. For this review, I would give this solution an overall rating of eight.

My usual use cases for SentinelOne Singularity Endpoint are to manage and deploy it on the endpoints across my organization. I also use it for automations, which represents my primary use case.

I use SentinelOne Singularity Endpoint mostly with my EDR. I am not heavily focused on cloud at this time as I am still in the development and learning phase of cloud deployment and cloud telemetry collection. Seeing alerts on a single pane of glass and resolving incidents has helped me significantly. It provides a better ecosystem with the AI team and all the capabilities already included.

The EDR feature of SentinelOne Singularity Endpoint and their detection features are excellent. They perform very well at endpoint detection and resolution. Their automated response capability is equally strong. There is also granular control over endpoint detection policies, which is valuable.

I have integrated SentinelOne Singularity Endpoint with Splunk, and the ingestion and correlation of logs and telemetry from endpoints is strong. It provides a good perspective on what exactly happened. This really helps me as a SOC analyst to investigate what has occurred on an endpoint if there is malware or a malfunction on that particular endpoint.

SentinelOne Singularity Endpoint has reduced the overhead of my alerts with the enhanced telemetry provided. I do not have a precise count, but it has had a significant impact. I estimate that I experience approximately twenty to thirty percent less alert overhead as they are automatically enriched and resolved.

SentinelOne Singularity Endpoint has helped reduce my team's time in analyzing alerts and determining what is wrong with endpoints. It also makes investigations easier without disrupting users. Mean time to detect and mean time to respond are metrics where I cannot provide exact numbers, but I can say that SentinelOne Singularity Endpoint has had a noticeable positive impact, making detection and response much faster than the very manual and tedious process we had before.

The positive benefits from using SentinelOne Singularity Endpoint include reduced effort required to interact with users during critical investigations. It has provided automation capabilities and advanced telemetry from endpoints to investigate any issues that arise. My team interacts less directly with users, so the impact to user business is minimized when cyber incidents occur and investigations are needed.

They could still work on optimizing their agent. Additionally, they do not appear to provide a free trial. If they could provide a free trial for one or two endpoints, it would be a better option for testing.

I worked with SentinelOne Singularity Endpoint at Infosys for two years and have continued using it recently, for a total of approximately three years.

SentinelOne Singularity Endpoint is reliable and stable. It does not create many issues.

I measure the stability and reliability of SentinelOne Singularity Endpoint based on how well it detects threats and how stably it performs in user environments. I do not want an EDR tool or agent to consume excessive resources from the endpoint. SentinelOne Singularity Endpoint manages this well. It would be better if it were more optimized, but overall it performs well.

SentinelOne Singularity Endpoint is scalable and easy to scale. We simply deploy it and it scales itself.

Scaling out might be a concern, but I have not had a need to scale down, so this has not been an issue.

I am not currently in touch with technical support for SentinelOne Singularity Endpoint as I am in the early deployment phase and am learning and brushing up on the platform myself. My peers have had interactions with technical support, and they have reported that it is excellent. Technical support is overall very strong, and though I do not have direct contact with them, the feedback I have received has been positive.

I previously used Quick Heal Endpoint and Quick Heal EPS, which were not sufficient for our advanced threat protection needs. We switched to SentinelOne Singularity Endpoint because of these limitations.

SentinelOne Singularity Endpoint is fairly straightforward to set up and has an intuitive user interface. A clear vision of your security policies is necessary, and a phased rollout is recommended. You cannot roll out the solution to everyone at once as it might impact many people simultaneously. A phased approach with policies tailored to your organization works best.

The cost of SentinelOne Singularity Endpoint is reasonable and appropriate for the features it provides. It is not too expensive or cumbersome. However, it would be beneficial if they could provide a free trial at some point.

I was considering Trend Micro Vision One as an alternative option, but SentinelOne Singularity Endpoint stood out.

I was evaluating Trend Micro Vision One and determined that SentinelOne Singularity Endpoint was the better option for my use case with one of my particular clients. As a consultant at a service-based firm, my role is to advise organizations on what will suit them best. For that particular client, this was the optimal choice, though other clients might benefit from different options. SentinelOne Singularity Endpoint was one of my top considerations for endpoint security along with Microsoft Defender for Endpoint for Windows-only environments.

SentinelOne Singularity Endpoint is a SaaS-based platform that I deployed on-premises. I would rate this solution a ten out of ten.

My main use cases for SentinelOne Singularity Endpoint are endpoint detection and response, real-time threat prevention, and incident investigations. It helps us protect laptops, desktops, and servers from malware, ransomware, and other advanced threats while providing centralized visibility into endpoints and their activity. I also use its automated remediation capabilities to quickly isolate infected devices, roll back ransomware where applicable, and reduce the manual response effort.

I can provide a specific example of how my team used SentinelOne Singularity Endpoint in a real situation. We received an alert from SentinelOne Singularity Endpoint indicating suspicious PowerShell activity on an employee's laptop. The platform correlated the behavior with a malicious Office document that had launched the script attempting to download additional payloads. SentinelOne automatically killed the malicious process, quarantined the file, and isolated the endpoint from the network to prevent lateral movement. Using the process timeline, the security team quickly identified the root cause, confirmed that no other endpoints were affected, removed the malicious document, and returned the device to service. The entire incident was contained within minutes without any ransomware encryption or data loss.

I have many use cases for SentinelOne Singularity Endpoint.

Since deploying SentinelOne Singularity Endpoint, I have seen faster threat detection and response, better visibility across our endpoints, and less time spent investigating security incidents. The automated containment and remediation features have reduced manual work for our security teams, and the centralized console has made it easier to monitor endpoint health and respond to threats.

I have seen faster detection with better context. Keeping our most critical security incidents in mind, the biggest improvement has been reduced investigation time thanks to the storyline features and automated remediation, allowing analysts to focus on the higher-priority security alerts.

The best features SentinelOne Singularity Endpoint offers that stand out to me the most are its behavioral AI detection, automated response capabilities, and detailed incident visibility. The storyline features, in particular, give a response timeline, while the process storyline makes it much easier to investigate the incident and understand exactly what happened.

SentinelOne Singularity Endpoint has behavioral AI detection, automated remediation and ransomware rollback, network isolations, storyline technology, threat hunting, remote response, and centralized management as the main features.

SentinelOne Singularity Endpoint can be improved in some areas. The management console can be complex for new users, and some advanced features require a learning curve to use effectively. Organizations with large environments may also want more flexible reporting and dashboard customization. While false positives are generally low, behavioral detection can still require analyst review and tuning to reduce unnecessary alerts.

I would like to see more customizable dashboards for executive reporting, simpler policy management and reduced false positives, faster support response times, deeper native integrations, more granular permissions, and easier onboarding and training.

I have been working in my current field for the last one year.

I have been using SentinelOne Singularity Endpoint for one year.

SentinelOne Singularity Endpoint is generally stable and reliable.

SentinelOne Singularity Endpoint has good scalability, ranging from small deployments to large enterprise environments. The cloud-based management model makes it easier to onboard, manage, and monitor large numbers of endpoints without needing additional backend infrastructure.

Customer support for SentinelOne is generally good, with knowledgeable technical teams and useful resources for troubleshooting and deployment questions.

I previously used another endpoint security solution and switched to SentinelOne Singularity Endpoint because I needed stronger behavior detection, faster incident response, and better automations. The previous solution provided basic endpoint protection.

I have seen a return on investment from SentinelOne Singularity Endpoint. The main value has come from reducing manual security operations, improved incident response time, and consolidating multiple endpoint security tools into one platform.

My experience with pricing, setup cost, and licensing is that the licensing model was relatively straightforward and cost-effective compared to my past solutions.

Before choosing SentinelOne Singularity Endpoint, I evaluated several endpoint security solutions including Microsoft Defender for Endpoint and CrowdStrike.

My advice to others looking into using SentinelOne Singularity Endpoint would be to clearly define your security goals and how SentinelOne Singularity Endpoint would fit into your existing security operations and deployment. I would rate this product a 9 out of 10.

I am currently working with SentinelOne products, specifically SentinelOne EDR and AI SIEM solutions. I have been working with SentinelOne Singularity Endpoint for the past nine months.

My use cases for SentinelOne Singularity Endpoint involve integrating multiple log sources from clients into a centralized platform. The platform has predefined rules, and I write custom rules based on threat hunts we are conducting. I analyze threats and alerts triggered by the platform to understand and respond to security incidents.

I work with the Ranger functionality for network and asset visibility in SentinelOne Singularity Endpoint.

SentinelOne Singularity Endpoint helps consolidate my security solutions in a different way than other products on the market. It offers new perspectives regarding threat fingerprinting and handling certain aspects of security. There are some limitations, but it is a growing product, and the team has made significant improvements since I joined, with new features continuously being developed.

The best aspect of SentinelOne Singularity Endpoint is its integration with AI, which provides initial analysis of alerts. It gives an overview of what the alert or threat is about and provides insight into what is happening.

SentinelOne Singularity Endpoint's ability to ingest and correlate across security solutions is valuable because it correlates data from the EDR module with custom rules I have defined. This correlation provides a complete overview of the incident and the overall capability.

SentinelOne Singularity Endpoint has helped me reduce alerts by correlating multiple data sources and grouping related alerts. This grouping makes it easier to investigate multiple incidents simultaneously.

SentinelOne Singularity Endpoint helps save time and free up my staff for other projects and tasks. It provides a brief description of each alert, which reduces investigation time so my team can focus on other priorities and increases overall productivity.

SentinelOne Singularity Endpoint has reduced my average MTDD and MTTR. The platform detects threats quickly, lowering the Mean Time to Detect, and provides brief alert descriptions that help close incidents faster, improving overall MTTR.

When retrieving results for logs in the AI SIEM of SentinelOne, there is a limitation where I can download up to 10,000 columns at a time, and the same constraint applies to vulnerability data. This product limitation needs improvement in future updates.

I would like to see these limitations removed in SentinelOne Singularity Endpoint. Additionally, the device control feature needs improvement. The EDR is solid, but there are several areas where the quality of work could be enhanced.

I have been using SentinelOne Singularity Endpoint for the past 9 months.

SentinelOne has not presented many stability issues. However, when searching for long-range queries, such as logs spanning three to four months, the platform sometimes takes extended time to retrieve the logs. Other than this, I have not encountered significant stability problems with the product.

I find SentinelOne Singularity Endpoint scalable.

I am aware of SentinelOne's tech support team. When I encounter agent issues, I create support cases, and the team usually provides a very good response with rapid turnaround. The support is available around the clock.

I have used other tools apart from SentinelOne, including CrowdStrike, Microsoft Sentinel, Microsoft Defender, and Carbon Black.

Having worked with tools like Defender and CrowdStrike, I can identify key differences in both pros and cons of SentinelOne. In Defender, you have limited information related to events, but in SentinelOne Singularity Endpoint, you have everything. When hunting on a specific device, you get all events including device events, network events, IP connections, and separate indicators to identify any indicators of compromise. SentinelOne has done significant work correlating these data points and keeping them separate so I can check each category independently while investigating alerts.

I am not certain how SentinelOne Singularity Endpoint was initially set up because the organization had been using it for the past five or six years before I recently joined them.

With new clients, I have not encountered many problems. From the EDR perspective, I did face some challenges related to SentinelOne Singularity AI SIEM where I had to find new ways of integrating all log sources, but I experienced nothing from the EDR perspective.

Purple AI plays a role in amplifying team knowledge and is quite effective in my environment. For example, when I receive an alert and want to see surrounding activities, if I am a person with no prior knowledge of SentinelOne Singularity Endpoint, building the query would be difficult to get new context and results. Purple AI helps by allowing me to provide a normal query or prompt, and it generates the query along with the results.

The key benefits from using SentinelOne Singularity Endpoint are that I have everything in a single platform. I have Ranger, the EDR module, AI SIEM, Purple AI to retrieve results, and vulnerability capabilities. I can correlate a single threat with all of these components to get a clear picture of what is happening in the environment.

I am using the SaaS deployment model for SentinelOne.

Ranger is important because it gives me visibility into how many devices in my network are unprotected. It provides security posture information showing how many detections exist, how many devices are protected, and how many are not. It gives an overview of what devices need protection and allows me to review why certain devices are not protected and identify any limitations.

The company name is SentinelOne.

I use Purple AI in SentinelOne.

Purple AI is an AI developed by SentinelOne that helps me correlate or build queries for those who have not used SentinelOne Singularity Endpoint before. It also provides information about the product without sharing confidential information. SentinelOne has a policy ensuring that all data and queries are kept internally and not shared with any third party.

Regarding workflow, Purple AI helps overall in my day-to-day operations by assisting with how alerts are triggered, retrieving results for alerts, providing alert descriptions from connected devices, and helping mitigate threats. I gave this review a rating of 8 out of 10.

I use SentinelOne Singularity Endpoint for my customers.

I help our customers implement SentinelOne Singularity Endpoint because its initial setup is straightforward and not complicated. However, there are cases where they are not integrated with Active Directory, so I assist them by sending the link or email to the end user so they can download the agent, and the rest can be done through the console.

My customers purchase SentinelOne Singularity Endpoint from us. I place the order with SentinelOne distributors because local support is more important for customers, and they want to be locally supported by resellers or vendors. If you buy from AWS, then there will not be any support.

My experience working with SentinelOne Singularity Endpoint has been fantastic.

The most valuable features I have found in SentinelOne Singularity Endpoint are MITRE ATT&CK, continuous monitoring, and threat vectors.

The drawbacks I have identified with SentinelOne Singularity Endpoint are that they should work on being more responsive than CrowdStrike. CrowdStrike has a very strong team here in the Middle East and they are very frequently available to discuss any kind of issues or challenges. In comparison to these, they are a bit slow.

I think in the next release of SentinelOne Singularity Endpoint, they should be working on a SIEM solution so that customers can have data logs for 30 days or 90 days.

SentinelOne Singularity Endpoint's R&D team should learn from CrowdStrike's approach, looking at the technologies that protect endpoints, customer protection, and providing extra features that customers can utilize and be loyal to them. For example, CrowdStrike gives seven days data retrieval for end users in the SIEM without any charges. If SentinelOne does something similar, they might gain more loyalty and more customers.

I have been dealing with SentinelOne Singularity Endpoint for more than five to six years.

When it comes to functionalities and performance, SentinelOne Singularity Endpoint is fine, and there are not many issues with SentinelOne Singularity Endpoint products once deployed.

I would rate their technical support around a nine out of ten. Every solution has some kind of drawback, but it is a pretty good score.

Its initial setup is straightforward and not complicated. However, there are cases where they are not integrated with Active Directory, so I have to assist them by sending the link or email to the end user so they can download the agent, and the rest can be done through the console.

I find SentinelOne Singularity Endpoint's pricing to be competitive because if I look at the pricing of CrowdStrike, they are competitive to CrowdStrike.

I cannot say SentinelOne Singularity Endpoint is the best option on the market at the moment, but I can say it is the second best. If I look at CrowdStrike, they have many other features and come with various other solutions including identity protection, SIEM, data protection, and firewall management. In terms of technology, SentinelOne is doing good and very competitive in the market, but CrowdStrike is still ahead of them.

I have not gone through SentinelOne Singularity Endpoint's Purple AI that much. I believe it is an AI feature. It is similar to all other AIs where you can ask questions about technical issues or challenges through the portal and it can access security, indicating if any configuration is missing or if there are any attacks or vectors, or if some users are inactive for longer periods. This can help them keep track of users in case some are offline for longer days or if their agent has not been updated. I would rate this review an eight out of ten.

My use case with SentinelOne Singularity Endpoint is primarily for security purposes, to secure our clients from different malware. If they download any suspicious file onto their desktop which creates a problem afterwards, then for that purpose, we are basically using this. We are basically an MSSP, providing services to our clients.

The features and functions in SentinelOne Singularity Endpoint that I have found most valuable include its fully autonomous nature. We don't have to put manual effort into that. Basically, mostly everything is automated, and also the threat detection feature, the rule remediation feature, and the rollback as I mentioned earlier. If anything comes out to be clean and genuine, then we can just do the rollback so that everything gets back to normal and keeps on running. I feel that is the foremost thing I appreciate: having a fast response and rollback capability.

Singularity Complete has helped me reduce the number of alerts. Although I would say that it is a depreciating factor when it comes to false-positive alerts. Initially, it generates a very high number of false-positive alerts, but by using it accordingly, very prominently, we can control the false-positive alerts by deploying only the necessary use cases that our clients need to detect only true-positive alerts rather than false-positive noises.

Singularity Complete helps my clients free up staff for other projects. I also mentioned earlier that it is fully autonomous. Every feature is automated. It does its work on its own by doing the quarantine. Any malicious thing it detects, its rule engine, which is obviously a behavioral AI. Because everything is automated, it decreases our manual effort. Rather than typing a manual email to a client, which obviously takes fifteen to twenty minutes extra, we are just taking action directly from the SentinelOne Singularity Endpoint user interface. So it reduces our manual effort and time overall.

Regarding potential areas for improvement for SentinelOne Singularity Endpoint, as I mentioned earlier, I felt that it was generating a very high number of false-positive alerts initially. Although by making a few changes, we reduced that. The first thing is the false-positive alerts. Also, I've felt that a few of our clients have a very high number of endpoints integrated, such as more than one thousand endpoints have been deployed for those particular clients. For those kinds of clients, I've felt that the resource consumption, including high CPU and disk utilization, is a factor. The utilization sometimes gets very high, so we have to keep it in control and monitor it from time to time. One more thing is creating a customized dashboard, which is not a feature in SentinelOne Singularity Endpoint. We can only view their existing dashboard. No custom dashboard feature is present in SentinelOne Singularity Endpoint, so that's also something that can be brought up in the future.

I've been working with SentinelOne Singularity Endpoint product for about a year.

Stability-wise, I would rate SentinelOne Singularity Endpoint a nine out of ten.

I would say ten out of ten for the scalability of SentinelOne Singularity Endpoint because we can scale up and scale down as per requirement. We can increase or decrease the number of endpoints, whatever suits perfectly at that particular time.

I would rate SentinelOne's technical support ten out of ten. There have been a number of times when we get in contact with their OEM, the customer support. Their response is very quick. Within a day, we get a response from them. There are a number of times we get stuck in creating a use case or doing whitelisting, blacklisting, or deploying rules. At that particular time, we contact customer support, and we get their response very quickly.

The initial setup for SentinelOne Singularity Endpoint is much simpler, although I have not been a part of the integration team. First, we have to allow SentinelOne Singularity Endpoint on a desktop, then we have to install its endpoint on the desktop or laptop.

The main competitor on the market for SentinelOne Singularity Endpoint can be CrowdStrike Falcon. I have not used that product, but I do know that the price range SentinelOne is offering is the best, as Falcon CrowdStrike is much more expensive.

My experience with SentinelOne Singularity Endpoint's ability to ingest and correlate data across security solutions is great because we personally have integrated SentinelOne Singularity Endpoint with a different product and deployed a few correlation use cases. By doing that, we strengthen our use cases, correlating it with different email security solutions. It's been great doing that correlation.

The Mean Time To Respond automatically decreases because everything has been already completed by the AI engine running in the background.

I have limited experience with Purple AI, but I have used some of the features, including identifying IOCs (Indicators of Compromise) in Purple AI and a few other features as well.

Regarding Purple AI's capabilities in threat intelligence for detecting threats, IOCs are utilized for that purpose. By using the copilot feature in Purple AI, where I can use the pull-down menu on the left-hand side, from there I can get the IOCs present on my client's endpoint. By doing that, I can gather threat intelligence on our clients' endpoints.

In my opinion, the main benefits that SentinelOne Singularity Endpoint provides are many. I would say it's already a valuable security device. I can literally line up different things that SentinelOne is offering. Obviously, the foremost thing is for security purposes. You are securing your own desktop, laptop, or whatever server it is. And also, what you are getting at such a low price, I would say. The foremost thing you are getting is the best that anyone can offer. So that's what I would say about SentinelOne Singularity Endpoint.

I have not personally used the Ranger functionality because it has been blocked in our environment, but I am aware of the Ranger functionality that SentinelOne is providing for network security purposes.

Regarding Mean Time To Detect (MTTD), if I compare it with other SIEM solutions, what does that SIEM solution do? It just detects an alert and gives a pop-up that the threat is detected in an environment. But comparing it with SentinelOne Singularity Endpoint, it is doing its work on its own. So, it's very useful compared to other solutions.

I will recommend SentinelOne Singularity Endpoint to other users. I would rate this product ten out of ten overall.

We are working for SentinelOne Singularity Endpoint. We are using SentinelOne Singularity Endpoint for endpoint detection to detect any suspicious malware detected in any PDF or file that users download and access. SentinelOne Singularity Endpoint marks suspicious or malicious files and takes appropriate action by quarantining that file in real time. This is the basic purpose that we are using SentinelOne Singularity Endpoint for.

We have integrated SentinelOne Singularity Endpoint with third-party tools such as our ManageEngine ticketing portal and a few other security devices. It works very well and we have not faced any issues yet.

The foremost thing would be that the response is very fast, and capability-wise, it is highly capable. Its automated features, behavioral analysis, and machine learning features are numerous, and I feel SentinelOne Singularity Endpoint is best for these aspects.

SentinelOne Singularity Endpoint has a faster response, so the mean time to detect is remarkably better than other products. This has improved the overall productivity for our organization, which is a plus point using SentinelOne Singularity Endpoint.

Because it is fully automated, the moment any threat is detected on any file or system, that very second it marks the alert and takes appropriate automated action on it. If any manual human intervention is required, then we, the analysts, are responsible for drafting a mail to our client. This has overall reduced our manual effort significantly, making it very beneficial.

I feel that it can be much better. Initially, it creates a lot of false positive alerts, which can be improved. SentinelOne Singularity Endpoint does not have any custom dashboard feature, so adding that would be better for us. We could create our own customized dashboard rather than using the default dashboard that SentinelOne Singularity Endpoint has.

Regarding CPU utilization, in a few of our clients, we have observed that the disk usage and utilization gets very high because they have lots of endpoints integrated on that particular client. This can be improved in that scenario as well.

It has been a few months that I have been using SentinelOne Singularity Endpoint, and I have had a great experience with it.

As far as I am concerned, I have not seen any downtime in SentinelOne Singularity Endpoint. There has not been any scenario where we have to wait to see whenever the device gets back up and running. There has not been any issue on that.

It is very much scalable. SentinelOne Singularity Endpoint charges on a per-endpoint basis, so whatever the requirement is, it charges the client on that basis. We can scale up and scale down whenever we want. If we want to scale up to a higher endpoint, then it is very much easy to scale up and scale down.

There have been a number of scenarios where I have felt that this is not my area of expertise to manage. In those kinds of times, I have been connected with the OEM and the customer support team of SentinelOne Singularity Endpoint. These scenarios include when creating a new rule or finding out IOCs on a client's endpoint. I would rate the customer support a 10 out of 10 because their response was very quick, within a day.

I have not been aware of other EDR or XDR solutions. This is my first EDR endpoint detection response team, so I am not aware of what other vendors are providing.

From what I am aware of, the deployment is very easy. You just have to install SentinelOne Singularity Endpoint agent on the desktop, laptop, server, or whatever device it is. Before installing, we have to allow its IP address and port in the firewall for better services. After that, we have to install SentinelOne Singularity Endpoint on the desktop and laptop.

Our return on investment is very much high. Our company is basically an MSSP, and we are providing managed services to our clients. By using SentinelOne Singularity Endpoint and providing its features to our clients, our company makes a huge amount of money. It is a great return of investment for our organization.

What SentinelOne Singularity Endpoint is offering for the price range is very remarkable. They are pricing on the basis of per endpoint. They charge around six to ten dollars based on the required amount of endpoints that are necessary. At this price range, the type of solution we are getting is the best that we can ask for.

We have a dedicated threat hunting team for that kind of thing, so I have never been a part of that threat hunting procedure in our team.

The analytics bar allows us to view every threat that has been observed in whatever time frame it is. By seeing that, we can directly assess whatever threats that have been observed on any endpoints and take a particular action on that.

There has been a scenario when SentinelOne Singularity Endpoint automatically remediated a threat, but the client confirmed us that the file is genuine and necessary for them. During that time, we used the rollback feature to get it back to the original state. By doing that rollback, we can roll back to our default settings. For that purpose, we use the rollback feature.

The rollback feature has saved us quite a bit of time. Doing it manually would have taken much more time. By directly doing the rollback, it has saved us more than an hour of time.

Everyone should go for SentinelOne Singularity Endpoint because at the price range that they are offering their services, it is the best that we can ask for. Everyone should keep SentinelOne Singularity Endpoint as their security device for their firm or their own personal purpose as well. I would rate this review a 9 out of 10 overall.

I work with SentinelOne Singularity Endpoint's complete Singularity Lake, which includes XDR, SIM, and everything integrated together.

I normally use SentinelOne Singularity Endpoint for endpoint management, with the EDR setup to get data from my endpoints. As an MSSP, I receive alerts and incidents and work on securing endpoints.

For mean time to detect, we promise less than 15 minutes for critical activity as an MSSP. This obviously depends on how good the platform is, and we commit to less than two hours for resolution. Obviously, this depends on many factors beyond what you can do from the platform. As an MSSP, you need to be very mindful that there are company resources which make the final call on whether to block something or not, whether it's malicious but still needed for that particular environment. So I normally commit to 15 minutes for MTTD and less than two hours for MTTR.

I think over the last one and a half years they have been improving significantly. Prior to that, they were also a very good product. In the market, there are hardly three products I can name: SentinelOne, CrowdStrike, Defender for Endpoint, and a bit of Cortex, but I am not that impressed with that product. These are the three major products that are doing very well in terms of their active EDR engine where you get the storyline correct—what exactly has happened, the parent process, child process, command line arguments. You get everything in a single fetch. Now with Purple AI, I think you get everything. Even an L1 engineer does not need to do anything complex. They can just write in natural language and get the details they need.

I think SentinelOne Singularity Endpoint presents a very holistic picture of an alert. Their enrichment layer is quite great. Once you get an alert, you get the complete process around it: how the parent process has started, which child process it has enabled, what kind of command line arguments or modifications have been done, what kind of scheduled task has been created, what kind of network connection you have, and what kind of file activity has occurred. You get everything in a single view.

In terms of their XDR, the consolidation is quite good. They have their own SIM and everything as well. The consolidation point has improved a lot, and you get everything under a single umbrella. This makes life much easier for MSSPs like me to manage a particular customer.

I think a few things are the confidence level you get in an alert. You get that very straightforward, so it is easier and you do not need to worry about it. The second thing is the automation level within the platform. Your alerts lifecycle has false positives reduced dramatically. You get all these features, and they help a lot. Also, the biggest factor is when I am opening SentinelOne Singularity Endpoint and presenting to a customer, the question is whether I can get a complete story of what has happened. That is where the most fatigue happens. When an alert occurs, people have to reach out to multiple sources to find out what exactly has happened. I think the story completeness is quite great with SentinelOne Singularity Endpoint.

The biggest problem for any organization is their L1 layer. That is where you spend more time when you get an alert, determining what exactly happened and whether it should be converted to an incident or whether it is a false positive or a true positive. Now with Purple AI and their LLM module, it is quite easier for the L1 engineers. The fatigue is quite low, and the alert to incident ratio has improved quite a bit. You know what is coming and what is not, and the L1 can add more value than they normally did before. Your load becomes easier on the L1 engineer, and obviously you can cut your costs there as well because one person can do more work. You do not need to teach any new language to manage SentinelOne Singularity Endpoint. As an MSSP, we can utilize the same L1 for multiple providers.

Since the enrichment layer is great and we get the data properly with deep visibility and the storyline is complete, the dashboarding is quite decent. You can make the call quite faster, and resolution time has decreased significantly.

The Purple AI features are notable. One of the most notable features is that you get a complete summarized alert. This works for someone who is not a great security L1 professional who has just joined from college or even for a more experienced professional who wants to see much data. You also get your AI verdict, indicating whether something is a true positive or false positive, so you get validation from AI. You get community verdict as well. If someone else has seen those alerts, you also see if there are similar alerts happening 1000 plus times, 10,000 plus times, or even just twice, or if it is only a standalone alert. Apart from that, you get a complete summary of what has happened, where it has happened, and why it has happened. You get complete details about what exactly has happened in a single click. So I think this makes life much easier for a respondent.

The two things that are top of my mind are Purple AI and the consolidation. What you get is detailed reporting and detailed RCA as well from them. The third thing is the storyline and complete visibility of what has happened and the complete flow of a particular attack vector. You get that very properly in SentinelOne Singularity Endpoint.

In terms of advantages, I think I will still use the AI visibility and the storyline. Most of the EDR providers use the same capabilities. Everyone has similar feature sets and everyone has been rated by ISG or other organizations. The end of the story that matters for every end customer or a provider like me is how well I can use it without getting too complicated. I have multiple stacks that I manage in my day-to-day, so how well their dashboard is, how well they are able to tell me the story around it, what exactly has happened, how exactly it happened, and how well they let me customize it matters. I think that is where SentinelOne Singularity Endpoint stands out. They are doing quite great there. At the same time, the Purple AI feature is much better. Imagine going for Copilot, which is a generic AI platform not specific to security. You may need to train it and work around it to get the exact responses you want. Apart from that, you pay for it, and you have to integrate it with your XDR or SentinelOne Singularity Endpoint, which creates lots of complications. When you get SentinelOne Singularity Endpoint, it is easier. Purple AI is already built into it, so you do not have to worry about it. You just buy it and can use it from day one.

I think they are doing pretty decent. The only thing is that once you are competing with someone like Microsoft and CrowdStrike, I think the investment should be slightly more in terms of a holistic view. Their threat feed is also limited. You get a very vast threat feed, but again it is not as mature as you get from a CrowdStrike or Microsoft stack. I think that is where they can look at it. Threat hunting is also something they do, so I think they can improve there as well. I think everyone is almost similar in that regard, so I think the rest of everything looks fine.

In terms of pricing, SentinelOne is slightly cheaper than CrowdStrike and Microsoft from what I have seen. Obviously, it is costlier than Sophos and a few other providers, but cheaper than those two. Deployment-wise I think it is there. I think the only thing is that Microsoft offers some free deployments to their customers with ECF funding and other options. I think that is something which Microsoft, being a bigger partner, has. Otherwise, I think they are doing good.

Regional availability is there, and I do know they are in most locations. In terms of compliance, there are some locations where I have seen them saying they still host on the US or EMEA region. I think the regional maturity is something they need to improve. I think otherwise, everything they are doing is quite good.

I have been using SentinelOne Singularity Endpoint for three to four years now.

I have not experienced any stability issues.

It is a very scalable environment. We have some large deployments on SentinelOne Singularity Endpoint, so the environment is very stable.

As a service provider, we manage most of the discussion in-house. Whenever we reach out to them, we get a very good response from them.

I think SentinelOne Singularity Endpoint is quite straightforward. They have been in the market, so the deployment and initial setup is quite easy. It is not a very tricky task and is very mature.

I think SentinelOne Singularity Endpoint is quite straightforward. They have been in the market, so the deployment and initial setup is quite easy. It is not a very tricky task and is very mature.

We purchased directly from SentinelOne.

As an architect, I do not work directly on ROI, but I think it is understood.

SentinelOne Singularity Endpoint sells on a SaaS model. For us, it does not matter whether it is AWS or Azure, but we work with Azure, AWS, and everything.

SentinelOne Singularity Endpoint sells on a SaaS model. For us, it does not matter whether it is AWS or Azure, but we work with Azure, AWS, and everything.

The ask is always simple from a customer standpoint. What exactly do you want to achieve, and what exactly is your problem base? Take a call in terms of what makes your life easier rather than having a very fancy-looking product and still having to learn a new technology or hire a new set of people. I think that is the concern most companies have. So just go for a genuine product which does serve the purpose and at the same time gets you out of the situations. I would rate this product and experience a 9 out of 10.