Palo Alto Networks Cortex XSOAR vs SentinelOne Singularity Complete comparison

Sponsored
 

Comparison Buyer's Guide

Executive Summary
 

Categories and Ranking

Microsoft Sentinel
Sponsored
Average Rating
8.2
Number of Reviews
86
Ranking in other categories
Security Information and Event Management (SIEM) (2nd), Security Orchestration Automation and Response (SOAR) (1st), Microsoft Security Suite (5th)
Palo Alto Networks Cortex X...
Average Rating
8.4
Number of Reviews
42
Ranking in other categories
Security Orchestration Automation and Response (SOAR) (2nd), SOC as a Service (2nd)
SentinelOne Singularity Com...
Average Rating
8.8
Number of Reviews
179
Ranking in other categories
Endpoint Protection Platform (EPP) (2nd), Anti-Malware Tools (2nd), Endpoint Detection and Response (EDR) (2nd), Extended Detection and Response (XDR) (2nd)
 

Featured Reviews

Harman Saggu - PeerSpot reviewer
Oct 31, 2023
Provides valuable alerts and saves investigation time, but can use more connectors
It is crucial that Sentinel empowers us to safeguard our hybrid, cloud, and multi-cloud environments. We employ a hybrid cloud setup, and securing our environment using Sentinel is significantly simpler than manual methods. We can gather events in the Central Point and develop playbooks and scripts to automate responses. This streamlines the process and enhances our overall security posture. Additionally, if an alert is triggered, we receive an incident notification via email, prompting us to take action and resolve the issue. Sentinel provides a library of customizable content to address our company's needs. Microsoft Sentinel has helped our organization with alerts. We'll receive alerts from Sentinel indicating that we're at risk. It's important to address these alerts promptly. We first need to review the information in the email, and then work on the issue in the office. After that, we'll contact the team members on the relevant shift. There's nothing particularly difficult about this process. It's based on our access privileges, which are determined by our role in the company. If we have a high-level role, we'll have access to all the necessary tools and resources. We'll even be able to receive alerts at home if there's a security issue. The company that provides this technology grants work-from-home access based on security considerations. If someone has a critical role, they'll also be equipped with the tools they need to work remotely and connect with their team members. So, the company that provided the technology can resolve the issue first, and then we can address it. Once we've taken care of the issue, everything will be much easier. By leveraging Sentinel's AI in conjunction with our playbooks for automation, we can enhance the effectiveness of our security team, subject to the specific rules and policies we implement. The logs provided by Sentinel have helped improve our visibility into our user's network behavior. Sentinel has helped us save 60 percent of our time by prioritizing the severity of the alerts we receive. When we receive an alert with a high-risk level, we immediately address it to mitigate the potential security threat. Additionally, we have configured our anti-ransomware software, to further protect our systems from cyberattacks. In the event of a ransomware attack, our Halcyon system will generate an encryption key that can be used to unlock our system. This key is securely stored by Halcyon. Sentinel has helped reduce our investigation times by enabling us to review an alert, generate a ticket, and resolve the issue simultaneously upon receiving the alert.
MA
Oct 19, 2023
A highly stable and scalable product that enables organizations to achieve SLAs faster
I rate the ease of setup an eight out of ten. The initial setup was straightforward. There were issues during integration. We found a lot of challenges in it. It should be improved. The deployment took around two weeks. Developing the playbooks took a long time. It could take a month or more. We deployed two main servers in the primary and secondary locations. We started the integration with a couple of technologies. During the third phase, we started working with the playbook development. After that, we started with the notifications and email templates. Finally, we did the test phase. We needed only one person for deployment and maintenance.
FirasAbu Ayyash - PeerSpot reviewer
Apr 16, 2024
Interoperable with the ability to ingest and correlate across security solutions
The XDR is very useful. The agent that collects data from servers is pretty effective. The interoperability with other SentinelOne solutions or third-party solutions is quite helpful. Our impressions of the solution's ability to ingest and correlate across our security solutions is perfect. We're satisfied with its capabilities in this regard. It's helped us consolidate our security solutions a bit. The Ranger functionality helps provide visibility. We're provided with security mapping for applications and can see end-to-end traffic. We also don't need to add agents or hardware or make network changes. It's easy to use. The Ranger functionality 10% helps prevent vulnerable devices from becoming compromised. It's reduced our alerts by about 80%. We have been able to free up staff time as it's not that time-consuming. It's helped us reduce our mean time to detect as we can now see issues in real time. It's also helped with our mean time to respond. We've been able to reduce organizational risk by 70% using this solution.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"It has a lot of great features."
"Previously, it was a little bit difficult to find where an incident came from, including which IP address and which country. So in Sentinel, it's very easy to find where the incident came from since we can easily get the information from the dashboard, after which we take action quickly."
"Its inbuilt Kusto Query Language is a valuable feature. It provides the flexibility needed to leverage advanced data analytics rules and policies and enables us to easily navigate all our security events in a single view. It helps any user easily understand the data or any security lags in their data and applications."
"The best feature is that onboarding to the SIM solution is quite easy. If you are using cloud-based solutions, it's just a few clicks to migrate it."
"The most valuable feature is the onboarding of the workloads. You can see all that has been onboarded in your account on the dashboards."
"The SOAR playbooks are Sentinel's most valuable feature. It gives you a unified toolset for detecting, investigating, and responding to incidents. That's what clearly differentiates Sentinels from its competitors. It's cloud-native, offering end-to-end coverage with more than 120 connectors. All types of data logs can be poured into the system so analysis can happen. That end-to-end visibility gives it the advantage."
"We didn't have anything similar. So, it really provides value from the incidents and automation point of view. The overview of the security fabric is most valuable."
"In Azure Sentinel, we have found, they do have a store in their capability. AI and intelligence features. We found that to be very helpful for us because some other things we do need to integrate again or find another vendor for the store"
"Cortex XSOAR's most valuable features are the playbooks, custom integration, the machine-learning model, and the layout, classifier, and mapper."
"The pricing is very good."
"The automation is excellent."
"The repository of playbooks and the integration between Palo Alto and IBM QRadar are some useful features"
"Its agility and scalability are valuable."
"Palo Alto is easy to use."
"The most valuable feature is automation."
"They have a portal where you can find any kind of integration that you need."
"The single pane of glass is probably the most valuable. That is a big one. We could see everything from one view."
"The tool deletes the problem-causing process and prevents issues."
"It is easy to collect and retain logs with SentinelOne."
"Device control and network control are valuable."
"The most valuable aspect of SentinelOne Singularity Complete is the protection it provides."
"The most valuable feature is the machine learning capability, as opposed to the traditional rule-based antivirus."
"The solution can search for hidden and dormant threats on encrypted traffic in your environment."
"Another valuable feature is that if a machine is infected, one that may infect other computers within the network, we have the capability of segregating that machine in the network so that it remains connected to the internet but is cut off from the other machines in the network. That helps prevent spreading of the infection. That's a very unique feature, one I have not seen in the last 10 to 15 years from any other antivirus program. That's amazing."
 

Cons

"There are certain delays. For example, if an alert has been rated on Microsoft Defender for Endpoint, it might take up to an hour for that alert to reach Sentinel. This should ideally take no more than one or two seconds."
"Multi-tenancy, in my opinion, needs to be improved. I believe it can do better as a managed service provider."
"The troubleshooting has room for improvement."
"It could have a better API to be able to automate many things more extensively and get more extensive data and more expensive deployment possibilities. It can gain some points on the automation part and the integration part. The API is very limited, and I would like to see it extended a bit more."
"Sometimes, we are observing large ingestion delays. We expect logs within 5 minutes, but it takes about 10 to 15 minutes."
"Everyone has their favorites. There is always room for improvement, and everybody will say, "I wish you could do this for me or that for me." It is a personal thing based on how you use the tool. I do not necessarily have those thoughts, and they are probably not really valuable because they are unique to the context of the user, but broadly, where it can continue to improve is by adding more connectors to more systems."
"There is a wider thing called Jupyter Notebooks, which is around the automation side of things. It would be good if there are playbooks that you can utilize without having to have the developer experience to do it in-house. Microsoft could provide more playbooks or more Jupyter Notebooks around MITRE ATT&CK Framework."
"We are invoiced according to the amount of data generated within each log."
"The solution is very expensive."
"It is been decommissioned by Palo Alto."
"The solution requires DV but does not support open-source DV elastic searches."
"There is room for improvement in terms of the pricing model."
"Palo Alto needs to develop more AI-centric products."
"The solution's correlation rules and playbooks should be improved."
"The solution should be made a bit cheaper."
"It's only one cloud right now. It might be helpful for some companies to have an on-premies option."
"We'd like to have a network map or scan to cover network security."
"DLP support would be a good addition."
"The grouping feature needs improvement."
"The reporting needs improvement and I would like to see a more granular level of administrative privileges."
"The stability of SentinelOne should be improved."
"All they need to do to improve it is for it to grow further. The hackers don't sleep. If the hackers don't sleep, the solution continually needs to be updated. They need to keep ahead of the hackers."
"I rate Singularity Complete a seven out of ten for affordability. It's more expensive than our previous solution, but it does its job well. At the same time, there is some room for improvement. Cheaper is always better."
"I would like to improve the reports because they are not so customizable and we would like more info from them."
 

Pricing and Cost Advice

"The cost of Sentinel is high. It typically costs more than $100 for five to ten users of the licenses or subscriptions. It costs around $123 per day on the cloud. Small- to mid-sized organizations would need a dedicated budget to adopt this solution; however, the cost may not be an issue for large, enterprise-level organizations."
"I am just paying for the log space with Azure Sentinel. It costs us about $2,000 a month. Most of the logs are free. We are only paying money for Azure Firewall logs because email logs or Azure AD logs are free to use for us."
"Microsoft is costlier. Some organizations may not be able to afford the cost of Sentinel orchestration and the Log Analytics workspace. The transaction hosting cost is also a little bit on the high side, compared to AWS and GCP."
"Microsoft Sentinel's pricing is relatively expensive and extremely confusing."
"Microsoft Sentinel can be costly, particularly for data management."
"The pricing is based on how much you ingest, so it's pretty straightforward. There are no tiers, and you pay for what you use unlike with other types of SIEM solutions that are usually based on tiers."
"The pricing is fair... With a traditional SIEM, you pay a lump sum for licenses. But with Sentinel, it's pay-as-you-go according to the amount of data you inject."
"Sentinel's pricing is on the higher side, but you can get a discount if you can predict your usage. You have to pay ingestion and storage fees. There are also fees for Logic Apps and particular features. It seems heavily focused on microtransactions, but they may be slightly optional. By contrast, Splunk requires no additional fee for their equivalent of Logic. You have a little more flexibility, but Sentinel's costs add up."
"The pricing is fair. The pricing reflects the value and feature set it offers."
"There is a yearly license required for this solution and it is expensive."
"There is a perception that it is priced very high compared to other solutions."
"The price of Palo Alto Networks Cortex XSOAR could be reduced. We are always looking for a discount. There is an annual license needed to use this solution."
"My company did not make any payments towards the licensing costs attached to the product since we were only using its pilot version."
"On a scale of one to ten, where one is a low price, and ten is a high price, I rate the pricing a nine."
"When I first looked at Demisto, it had a price tag of $250,000 but when we finally purchased it, it was $345,000."
"The solution's pricing needs improvement."
"This solution is less expensive than its competitors."
"I can pay, for my environment, between $30,000 and $40,000 a year, and that's a pretty good deal."
"My understanding is that we did a pretty good deal on SentinelOne. A part of that is because we were their customers very early on, and we also use their products a lot. We are interested in the new products that come out. We go to their demos, and we go to their events. We do save a lot of money. It is not cheap, but it is worth it. We spend a lot of money on a lot of things, and most of them do not do as much as SentinelOne."
"The one I use is $6 a month per device. Some are $4 and there are some that are more than that."
"SentinelOne was half the price of CrowdStrike."
"It is not sold as a consumer product. It is only sold based on the number of licenses. So, as an MSP, you're probably going to pay about three and a half dollars per license, per month to have SentinelOne."
"The pricing level for this service and application was very interesting for us. I don't know exactly what the price was, but apparently it was a big surprise that the SOC was also included in our pricing model."
"The larger count you have, the deeper discount you will receive in your contract."
report
Use our free recommendation engine to learn which Security Orchestration Automation and Response (SOAR) solutions are best for your needs.
787,779 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Computer Software Company
16%
Financial Services Firm
10%
Government
9%
Manufacturing Company
7%
Financial Services Firm
13%
Computer Software Company
13%
Government
9%
Manufacturing Company
8%
Computer Software Company
18%
Manufacturing Company
7%
Financial Services Firm
6%
Government
6%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
 

Questions from the Community

Is there a common threat intelligence tool that aggregates multiple threat intelligence sources?
Yes, Azure Sentinel is a SIEM on the Cloud. Multiple data sources can be uploaded and analyzed with Azure Sentinel an...
What is a better choice, Splunk or Azure Sentinel?
It would really depend on (1) which logs you need to ingest and (2) what are your use cases Splunk is easy for ingest...
Which is better - Azure Sentinel or AWS Security Hub?
We like that Azure Sentinel does not require as much maintenance as legacy SIEMs that are on-premises. Azure Sentinel...
What is your experience regarding pricing and costs for Palo Alto Networks Cortex XSOAR?
Whether the product is cheap or expensive depends on the company and how much they are willing to spend on security. ...
What needs improvement with Palo Alto Networks Cortex XSOAR?
The solution is complicated to learn. Customers find it difficult to learn how the solution works. We need profession...
Cortex XDR by Palo Alto vs. Sentinel One
Cortex XDR by Palo Alto vs. SentinelOne SentinelOne offers very detailed specifics with regard to risks or attacks. ...
Which is better - SentinelOne or Darktrace?
Which solution is better depends on which is more suitable specifically for your company. Darktrace, for example, is ...
What do you like most about SentinelOne?
The AI solution makes it easy for customers to detect and manage policies, as well as documents that help customers m...
 

Also Known As

Azure Sentinel
Demisto Enterprise, Cortex XSOAR, Demisto
Sentinel Labs, SentinelOne Singularity
 

Overview

 

Sample Customers

Microsoft Sentinel is trusted by companies of all sizes including ABM, ASOS, Uniper, First West Credit Union, Avanade, and more.
Cellcom Israel, Blue Cross and Blue Shield of Kansas City, esri, Cylance, Flatiron Health, Veeva, ADT Cybersecurity
Havas, Flex, Estee Lauder, McKesson, Norfolk Southern, JetBlue, Norwegian airlines, TGI Friday, AVX, Fim Bank
Find out what your peers are saying about Microsoft, Palo Alto Networks, Splunk and others in Security Orchestration Automation and Response (SOAR). Updated: June 2024.
787,779 professionals have used our research since 2012.