SentinelOne Singularity AI SIEM Reviews

In my daily work, the main use case for SentinelOne Singularity AI SIEM is creating rules, fine-tuning, source recording, rule creations, and when any alerts are triggered. We can raise them to the client side, continuously monitoring any alerts. We can raise them to the client side for early resolution, also creating the dashboards, checking the logs, and agents installation. Those are the day-to-day tasks in our SIEM tool.

Alert fighting is a specific example of a recent situation where I used SentinelOne Singularity AI SIEM for one of these tasks. Sometimes multiple alerts are triggered in the SIEM. At that time, we analyze what type of alert it is, whether it is a true positive or false positive. That is challenging for me.

Our day-to-day tasks include alert raising, continuous monitoring, raising the alerts, dashboard managing, creating the dashboard, rule creating, and decoder creating. If there is any requirement from the client side, we will also do these types of activities, creating any new rule.

When I have those multiple alerts and I need to figure out if they are true positives or false positives, I usually check in Deep Visibility if it belongs to any suspicious fields or anything malicious, or if it is a true positive belonging to our organization. I also check if it belongs to any suspicious sites, IPs, or IOCs such as malicious IPs or malicious hashes, or if it belongs to any malicious paths. I will check the source, the destination, and what it is doing. We can check if the path belongs to a genuine path or a suspicious path. We will do that type of analysis and then I will specify if it belongs to a true positive or a false positive. We can follow those types of steps.

SentinelOne Singularity AI SIEM offers the best features that belong to the AI. This includes automated alerts. We can also do the automated alerts on these fields. I can create multiple types of use cases. It means we will create multiple types of use cases for our requirements. For example, if we have blocked any suspicious or malicious app in the environment, we can block these. That is a best feature, and Purple AI is also a best feature in SentinelOne Singularity AI SIEM tools. Deep Visibility is also a best feature because we can check multiple types of activity, such as what it is doing, what activities it is currently performing, and what the steps are. There are multiple types of best features in there.

I will give an example of how Deep Visibility has helped me in my investigations or daily work. If any suspicious or malicious malware types of alerts are triggered in SentinelOne Singularity AI SIEM, then I will check the source of this with the help of Deep Visibility. Deep Visibility is basically for when any alerts are triggered on any endpoint. You can see what types of activity are being done, what is being downloaded, and what types of history there are. You can check the source, the destination, and what systems are doing this activity. I will check that type of feature in Deep Visibility.

SentinelOne Singularity AI SIEM has impacted my organization positively because I am observing some improvement. There are multiple tool alerts in our organization, but SentinelOne Singularity AI SIEM feature is real-time monitoring and real-time threat detection. With the help of our and the client's organization, it is secure. There are improvements. Those types of improvements are better for securing our organization from anything suspicious or any malicious types of alerts.

There are faster response times available with SentinelOne Singularity AI SIEM. Also, there is the automation alert. We can set any parameter on SentinelOne Singularity AI SIEM source, and it will automatically raise an alert to the client side. We can also integrate that type of feature with SentinelOne Singularity AI SIEM. With the help of alert raising, there is the fastest way to raise an alert. That is the best feature and there is a very big improvement.

SentinelOne Singularity AI SIEM is the best, but sometimes the dashboards are a little simple compared to other tools. The custom dashboard is not available in their features. Therefore, I would suggest adding the custom dashboard for any of our requirements.

The AI-driven analytics from SentinelOne Singularity AI SIEM has not affected our ability to reduce false positives.

SentinelOne Singularity AI SIEM has affected my SOC's efficiency in investigating alerts and responding to incidents. If we receive any alerts, we can observe what activity is being done. We can see if it is malicious or something suspicious, or a true positive. We can analyze the path, the hash, and whether the signature is verified or not. We can see if it is an alert triggered by any engine. We can see the source of this. We will do that type of analysis and raise it to the client side. Also, if I identify anything suspicious or malicious in the alert, I will forcefully kill and quarantine it immediately.

I have been working in my current field for the last two years and five months.

SentinelOne Singularity AI SIEM is stable.

The pricing for SentinelOne Singularity AI SIEM is best, and it has very easy features for understanding. There are multiple tools with various types of features, but SentinelOne Singularity AI SIEM provides some features, maybe fewer features, but they are very useful features. We can say that to the client. Also, the integration parts are easy. It is cloud-based, and there are multiple automation activities also being done. It is an easy way to work, and minimum workers are needed. SentinelOne Singularity AI SIEM is doing multiple types of activities because there are automated tools with AI features. There are also Deep Visibility and multiple Purple AI types. It has multiple best features. We can suggest those types of things to the client for purchasing SentinelOne Singularity AI SIEM.

I will give SentinelOne Singularity AI SIEM a ten out of ten on scalability.

I rate SentinelOne Singularity AI SIEM a ten out of ten because there are the best features in there. There are multiple types of features such as auto-raising, automation, AI features, and the Deep Visibility feature. There is an improvement in our organization to be faster to secure our organization's safety. That is why I will give it a ten out of ten. The integration part is also best. It is a ten out of ten from my side. That is why I give it a ten out of ten.

The customer support for SentinelOne Singularity AI SIEM is also the best because we have raised tickets to the support center multiple times. The support team gives an immediate answer, within ten to fifteen minutes. They also schedule calls and troubleshoot the alerts and solve the issue. The support team is very best.

I rate the customer support for SentinelOne Singularity AI SIEM a ten out of ten.

In our organization, we previously used the CrowdStrike solution.

We switched from CrowdStrike to SentinelOne Singularity AI SIEM because our organization is an MSSP organization. That means I provide services to the client. We had twenty to thirty clients in our organization that we managed. Twenty-seven or twenty-eight clients were using SentinelOne Singularity AI SIEM, but only one or two clients were on CrowdStrike. Their client also switched to SentinelOne Singularity AI SIEM. That is why, at this time, we are only managing SentinelOne Singularity AI SIEM.

The integration part for SentinelOne Singularity AI SIEM is very easy. Any fresher can easily do this. The agent installation is also so easy. Within one to two minutes, we can install SentinelOne Singularity AI SIEM agents in the environment or client environment network. It is the best, fastest installation.

I have seen a return on investment with SentinelOne Singularity AI SIEM. The tool also saves our money and time. The pricing is very medium, and time is also saved because there are automation features available. That is why multiple alerts are raised by the automated process. In those times, manual alerts are less frequent compared to other tools. It is helpful. Sometimes, in our organization, two people are working on these AI-driven features in SentinelOne Singularity AI SIEM. But when the automation features are started, one person can also manage the console. It is money saved, and the automation and those types of activities are doing the automated alerts. One person is only managing and checking if the alerts are going properly. That is why it is also money-saving. It is a money-saving tool, and the pricing is also low. Any small or startup organization can also buy it easily.

My experience with pricing, setup cost, and licensing for SentinelOne Singularity AI SIEM is that the setups are very easy for any fresher. Any basic knowledge can also do the setups. Regarding the pricing, it is not heavy. It is in the middle, not high, not low. Any small organization can also purchase this. Compared to another SIEM tool's pricing, the pricing is the best, from my side.

Before choosing SentinelOne Singularity AI SIEM, I did not evaluate other options because SentinelOne Singularity AI SIEM is the best according to me. We have used other tools, but SentinelOne Singularity AI SIEM has multiple types of features and it is an easy-to-understand tool. That is why I am choosing SentinelOne Singularity AI SIEM.

The accuracy and reliability of output from SentinelOne Singularity AI SIEM are very high. SentinelOne Singularity AI SIEM is very accurate. It is also very reliable. We have not found any glitching. It is faster, and it also has real-time threat hunting and real-time detection. That is the capability in there.

The real-time monitoring feature of SentinelOne Singularity AI SIEM helps with Deep Visibility. If any malicious or suspicious alerts are triggered, I will check the alert. We can analyze this alert with the help of Deep Visibility. We can see its source, its destination, what it is trying to do, and if the path is genuine or not. We receive the alerts and we can do this type of investigation. Then, if anything malicious happens, we can raise it to the client side for notification purposes. We can say we observed this type of alert at this time, and it is this type of malicious activity.

My impression of the AI-driven threat detection capabilities of SentinelOne Singularity AI SIEM is that it is the best feature because multiple alerts can be happening, but the AI-driven features immediately block them. Any alerts are blocked before they happen. And it gives the action, such as killing and quarantining the threat.

I give SentinelOne Singularity AI SIEM an overall rating of ten out of ten.

I use SentinelOne Singularity AI SIEM for security operations. An AI-powered SIEM uses machine learning, and for us, the primary value is reducing manual investigation effort while improving the detection of threats that traditional rule-based SIEMs may miss. SentinelOne Singularity AI SIEM has Purple AI for that purpose. Analysts can use natural language to investigate security data and generate queries. It also has unified security data analytics, which allows us to analyze endpoints, firewalls, identity, cloud, and third-party security logs from a common platform without switching between tools. If a potentially compromised employee account exists, a traditional SIEM may generate separate alerts for each event. However, SentinelOne Singularity AI SIEM can help correlate the events, summarize the investigation, and identify the relationship between them.

A particular example of my use is creating a detection rule. I used SentinelOne Singularity AI SIEM AI and machine capabilities to develop detection logic, generate a query, and ingest logs. Purple AI helped me build the detection logic, but I still validated and deployed the rule. I wanted to create a custom detection rule for external port scanning activity. I analyzed the available FortiGate firewall logs and identified the source IPs originating from external networks. I grouped events by source IP and destination IP, counted the unique destination ports scanned, and used Purple AI by entering a prompt regarding all of this. I reviewed the generated query and confirmed the fields that match with my FortiGate logs. I executed the query and adjusted the threshold, then created the scheduled detection rule using the validated query. I tested it and performed tuning as required.

I also use SentinelOne Singularity AI SIEM for rule and detection development. I developed detections for repetitive failed VPN login attempts. I analyzed gaps with Purple AI and detected data exfiltration using Purple AI.

SentinelOne Singularity AI SIEM has the potential to improve my organization's security operations by reducing manual investigation efforts, accelerating threat detection, and improving the efficiency of the SOC. Its AI-powered threat hunting and detection engineering capabilities help us develop better detection rules, identify security threats more effectively, and streamline incident response. This has led to improved operational efficiency and better utilization of our security analysts' time.

I have observed time savings in security investigations and detection rule development. AI-assisted techniques reduce the time spent manually writing queries and analyzing security logs. It helps correlate related events and identify relevant evidence faster, allowing our SOC to investigate incidents more efficiently and focus on critical security activities. An example of time savings I have observed is with AI SIEM threat hunting. AI performed investigation using natural language and quickly identified relevant activity, which reduces the time spent on manual log analysis and allows our SOC to focus on validating findings and responding to threats. It also simplifies detection rule development by generating and refining queries.

I have used automated workflows to streamline repetitive security operations tasks. Automating routine activities such as alert enrichment or event handling and response helps reduce manual intervention and improves operational efficiency. This also reduces alert fatigue, allowing our SOC team to focus more on threat investigation and incident response rather than repetitive administrative tasks.

The automated workflows have the potential to reduce false positives by enriching the alerts with contextual information and filtering. This has reduced unnecessary alert handling and improved SOC efficiency. However, the effectiveness depends on the quality of detection rules and workflow configurations. Continuous tuning and validation will remain necessary to ensure genuine intrusions are not overlooked.

I find SentinelOne Singularity AI SIEM efficient in supporting our SOC operations. Its AI-powered threat hunting and investigation capabilities help reduce the effort of manually analyzing security logs and correlating events. The platform also assists in developing and refining detection queries, improving the efficiency of threat investigations. However, the accuracy of the generated queries and the need for manual validation can affect the overall efficiency, particularly when working with complex or third-party log sources.

I assess SentinelOne Singularity AI SIEM efficiency by measuring how much time it saves in daily SOC operations, how accurately it identifies threats, and how much manual work remains. I also assess the efficiency of SentinelOne Singularity AI SIEM based on security activities done manually for threat hunting, detection, and incidents. For example, investigating external port scanning activity traditionally requires manually filtering firewall logs, correlating events, and calculating investigation reports. Assisted investigation helps simplify this process by identifying relevant events and assisting with query development. This improves detection efficiency, although the generated queries still require analysts' modification.

If a Windows endpoint starts communicating with a suspicious external IP, SentinelOne Singularity AI SIEM can correlate firewall logs with endpoint telemetry to help identify the affected system. If the activity is confirmed as malicious, the SOC can isolate the endpoint. SentinelOne Singularity AI SIEM does not directly prevent system downtime. It is entirely dependent on detection quality, response speed, and whether required mitigation and response actions were taken. SentinelOne Singularity AI SIEM can help reduce the potential impact of security events on system availability by improving threat detection and investigation speed.

I believe my organization's security posture has improved with the implementation of SentinelOne Singularity AI SIEM. The platform provides better visibility into security events across multiple data sources and helps identify suspicious activities more efficiently. Its AI-powered threat hunting, event correlation, and investigation capabilities support faster threat identification and improve our ability to detect potential attacks. It also assists in developing and refining detection rules, helping us address detection gaps and strengthen our monitoring capabilities. Overall, the platform has improved our security visibility and investigation efficiency, while continuous detection tuning and analysis remain essential to maintaining an effective security posture.

Consolidating security data from multiple sources into SentinelOne Singularity AI SIEM has helped streamline our SOC operation by providing a centralized view of security events. Instead of switching between different tools to investigate suspicious activities, analysts can correlate and analyze data from multiple sources within a single platform. This improves investigation efficiency, reduces manual effort, and simplifies threat hunting. It helps our team identify relationships between events that might otherwise remain unnoticed.

The best features of SentinelOne Singularity AI SIEM are the AI-powered threat hunting and investigation, natural language search, and the ability to query data so I can search with my own language with Purple AI. Custom detection rules and correlation of security events across multiple data sources, real-time threat detection and alerting, integration with SentinelOne EDR and XDR and third-party security products, data normalization and log parsing, historical log analysis for identifying attack patterns, and automated response and orchestration workflows are all valuable.

AI-powered threat hunting using natural language stands out the most to me. It allows me to investigate security data using plain language questions instead of manually writing complex queries. This reduces the time required for threat hunting and makes investigations more accessible for analysts who are less familiar with query languages. I was not that much familiar with the SentinelOne query language before. During the first six months, I was not familiar with the query language, but now I am an expert. However, analysts who are less familiar with query languages can use Purple AI to query SentinelOne data using plain English.

Another standout feature worth mentioning is AI-assisted detection engineering. Unlike simply using AI to summarize events, this focuses on helping me develop, investigate, and refine detection logic. It can make detection engineering more accessible and reduce the manual effort involved in writing and troubleshooting queries. Other features that may stand out are assisted investigation, explainable AI verdicts, and OCSF normalized data. Assisted investigation is a strong feature to mention alongside the features I have mentioned.

SentinelOne Singularity AI SIEM can improve in several areas. AI accuracy is one area where the platform can improve the accuracy of AI-generated queries and investigation findings, especially for complex log formats. Detection rule creation should be easier, making it simpler to convert AI-generated queries into production-ready detection rules. False positive reduction is another important area where improved detection tuning is needed to reduce unnecessary alerts and manual triage. For example, SentinelOne Singularity AI SIEM can catch SentinelAgent.exe as a potential threat, but it should not because it is the agent of SentinelOne itself. Third-party integrations should be improved because the platform does not integrate with some Microsoft-related products currently. Expanding out-of-the-box integrations and simplifying the onboarding of non-SentinelOne data sources would be beneficial.

Log parsing should be improved by enhancing automatic extraction and normalization for custom and third-party logs. Investigation transparency should provide clearer explanations of why an event was classified as suspicious or malicious because the AI is constantly classifying SentinelOne agent as suspicious. The platform should support more formats and optimize costs by improving query execution and optimizing data and storage costs.

The accuracy of SentinelOne Singularity AI SIEM is generally useful for threat hunting and security investigations. However, AI-generated queries may require manual validation, particularly when dealing with complex log formats or custom data sources. Sometimes, query results may need refinement to avoid false positives or may miss some relevant events. Improving query accuracy, field mapping, and consistency across third-party observability would make the platform more reliable and reduce the need for manual troubleshooting.

I have been using SentinelOne Singularity AI SIEM for approximately two and a half years.

I find SentinelOne Singularity AI SIEM is generally stable for security monitoring and investigation. It is cloud-based and provides consistent access to security data across multiple sources. It can be affected by log ingestion delays, query performance issues, and issues with third-party data. For example, daily investigations involving large volumes of firewall logs depend on query performance and availability factors. Overall, the platform provides a reliable foundation for SOC operations. Continuous monitoring of data ingestion and integrations is essential to maintain consistent performance.

I find SentinelOne Singularity AI SIEM scalable in terms of adapting to my organization's evolving security events. Its cloud-based architecture allows us to expand security monitoring as the volume of endpoints, logs, and data sources increases without requiring significant changes to our underlying infrastructure. The platform's ability to integrate data from different security products also supports the onboarding of new log sources as the environment grows. For example, we can extend monitoring to additional firewalls, cloud, and on-premises environments while maintaining centralized visibility. Its AI-powered threat hunting and investigation capabilities further support scalability by helping analysts manage increasing volumes of security data more efficiently.

I find SentinelOne Singularity AI SIEM scalable and capable of supporting growing security monitoring requirements. The cloud-based architecture allows us to expand and integrate additional security data sources without changing underlying infrastructure. From stability to security data, it supports assisted threat hunting with increasing volumes more efficiently. For example, integrating firewall logs can be extended while maintaining centralized visibility. The platform has met our needs, but data migration capacity, integration complexity, and licensing costs must be considered.

My experience with SentinelOne customer support has been positive. The support team provides assistance with technical issues and product queries. Response times and resolution timelines can vary depending on the complexity. For example, issues involving log ingestion or third-party integrations may require additional investigation and coordination. Overall, customer support is helpful, but faster resolution of complex technical issues and more communication would be better.

I used Wazuh, which provided flexibility for log collections and a custom rule-based detection model. However, managing integrations, writing detection rules, and management required considerable manual effort. SentinelOne Singularity AI SIEM offers a more streamlined approach to AI-assisted threat hunting, natural language query assistance, and centralized data analysis. These capabilities can reduce the effort required for detection engineering and investigations. The main advantage is improved operational efficiency and simplified security analysis rather than the complete elimination of some technical tools or manual investigation.

I have experienced operational benefits from SentinelOne Singularity AI SIEM, which has reduced the time required for security investigations and detection rule creation. For example, investigating suspicious firewall activity traditionally involves manually filtering logs, but assisted investigations help simplify this to identify relevant events more quickly and spend less time on such tasks. Consolidating security data also reduces the need to switch between multiple tools during investigations. These improvements contribute to better utilization of SOC resources and potential cost savings through reduced manual effort. These are the direct forms and data of interest for return on investment, and the actual savings depend on investigation volume, analyst efficiency, and efficiency costs. I get every endpoint at a reduced cost, below the market value. The ROI may be better than I expected.

My experience in pricing and licensing has been primarily from an operational perspective. The platform's cloud-based data model simplifies infrastructure management and reduces the need for maintaining security system hardware. Pricing transparency and license flexibility are important considerations as the volume of security data and number of environments increase. Having clear visibility into data ingestion costs, licensing, and the impact of expanding integrations would help my organization plan its operations more efficiently.

I did not evaluate any other option because my company was already a partner of SentinelOne, and then we approached SentinelOne for AI SIEM, specifically SentinelOne Singularity AI SIEM. There were not any other options for me. Additionally, we trusted SentinelOne so much that we switched to AI SIEM without any hesitation.

I would rate SentinelOne Singularity AI SIEM an eight out of ten because it stands out in AI-powered threat hunting. The natural language query assistance is valuable for newer SOC analysts. Automated investigation, event correlation, and detection rule development are excellent. I have deducted two points because it could improve more on accurate AI-generated queries and easier conversion of queries into production rules, better third-party log parsing, and reduced false positives.

I find SentinelOne's governance and security approach valuable, particularly in its centralized security data management and AI system investigation capabilities. The platform provides visibility across multiple security data sources while allowing analysts to remain involved in investigation and response decisions. I would also like to see more granular controls over AI's interactions, clearer audit trails, and improved visibility into how AI reaches its conclusions. These enhancements would further strengthen trust, accountability, and governance with SentinelOne Singularity AI SIEM.

SentinelOne Singularity AI SIEM is deployed as a cloud-based SaaS solution in a public cloud. It allows us access to security monitoring, threat hunting, and investigation without maintaining the underlying SIEM infrastructure on premises. This simplifies deployment, infrastructure management, and provides scalability as security monitoring requirements grow.

I would recommend SentinelOne Singularity AI SIEM to those looking to improve their security monitoring. Its AI features can simplify complex queries, reduce manual investigation efforts, and provide better visibility across multiple security data sources. Organizations should evaluate their requirements, integration capabilities, and licensing costs before adoption. I would also recommend rule tuning and automation tuning. Overall, it is a valuable solution for SOC teams to improve their operational efficiency and strengthen their security posture.

SentinelOne Singularity AI SIEM is a tool that we use to support our clients. Our organization is a service-based organization, so we use SIEM to provide services to software-based clients. We are a partner with SentinelOne.

The best features of SentinelOne Singularity AI SIEM include its ability to give you a brief description of what the alert is about. When an alert is triggered with AI SIEM, we have a basic analysis of what the alert is about, and it will give you the understanding of what the alert is.

I especially value that analysis feature. If you get an alert in SentinelOne Singularity AI SIEM, we have an auto-investigate tab as well. If you click on that auto-investigate tab, it will correlate with all the products and data sources it has, and it will give you a deep analysis of what the alert is and what is happening, so everything is covered.

The real-time monitoring is pretty good. It correlates between all the different data sources that have been integrated with SentinelOne Singularity AI SIEM. It will correlate everything and give you a pretty good storyline of what the alert is about.

Overall, this affects my security posture positively because it improves it since it helps us in real-time monitoring, and it gives us automated investigation and also the auto-investigate tab, so it is pretty good.

My impression of the AI-driven threat detection capabilities is that it helps a little bit, but they need to tune it a bit because we are seeing too many false positives recently. Since we are a partner with SentinelOne, we are working along with them to tune those out.

I assess the efficiency of SentinelOne Singularity AI SIEM in improving our responses to sophisticated threats as not having improved a lot because, as I mentioned earlier, there are a few things that need improvement, including the false positive rate. Since we are seeing too many false positives, even if a true positive comes, it is harder for us to determine the difference between the false positive and true positive.

The effect on our SOC ability in reducing false positives has not been significant. We have opted for the possibility of doing some automation. Because of that automation, if SentinelOne Singularity AI SIEM already does the basic analysis, it will close out a few of the false positives, but not that much. I would say around ten to twenty percent of the alert volume is reduced.

The areas that need improvement with SentinelOne Singularity AI SIEM include faster responses. The tool is a bit slow since it is under development, so it is not that fast. They also need to improve on developing more use cases that will help determine the true positives.

I have not worked with any SIEM that is integrated with AI, but if I compare SentinelOne Singularity AI SIEM with Microsoft Sentinel, Sentinel has some use cases that are kind of true positives and all. Here, they need to improve on the tool functionality and faster responses.

I have been using SentinelOne Singularity AI SIEM for the past one and a half years.

I rate the stability of SentinelOne Singularity AI SIEM as pretty stable unless there is an upgrade. But if you run too many queries, it will be down.

The scalability of SentinelOne Singularity AI SIEM is pretty good; I would rate it around a nine.

I would rate the technical support around five.

I rate it five because even if you raise a case with SentinelOne support, you will not get that fast of a response. Even if you raise a P1 or P2, you have to engage back-end support in order to get a response from them. That has been a major drawback in the tool. Also, even if you get a response, it will be a generic response.

The alert volume has been reduced by around ten to twenty percent.

The pricing for SentinelOne Singularity AI SIEM is cheap when compared with other tools. I do not know the exact prices, but I heard it is cheap when compared with the other tools in the market.

In my organization, approximately eighty people work with SentinelOne Singularity AI SIEM.

Our clients vary in size; we have small businesses, medium enterprises, and large enterprises as well.

SentinelOne Singularity AI SIEM does require maintenance in that we manage the integration and everything, but the tool UI and everything is updated by the SentinelOne team itself. We do not upgrade anything.

Doing updates for SentinelOne Singularity AI SIEM is easy.

I evaluate the efficiency in investigating alerts and responding to various incidents as pretty good; they have a pretty good collection of events. You will have all the events that you need to do an investigation, and I would say it is pretty good. Once you start working with the tool, you will have pretty good responses in the event search to investigate.

We are using the automated workflow feature in order to reduce the number of false positives. With that, benign threats and all will be there, so we are just closing them out. It is reducing the volume of alerts for now.

The advice I would give others looking to implement SentinelOne Singularity AI SIEM is that it has its pros and cons. If you are looking for a decent tool for investigation, it is good. But if you are a large enterprise and if you have loads of logs that are being ingested, I would say just think about it because we are having issues while handling large clients and pulling a larger number of logs. I would rate this product an eight out of ten.

The primary use cases for SentinelOne Singularity AI SIEM are that we are using it as a replacement for Secureworks. We migrated to and switched to SentinelOne.

SentinelOne Singularity AI SIEM has positively affected my SOC's efficiency in investigating alerts and responding to incidents. Most of the functionality between Secureworks and SentinelOne Singularity AI SIEM is comparable, as both work in the same space.

We primarily switched to SentinelOne Singularity AI SIEM because of its native integration capabilities. We did not need to integrate with other tools because Secureworks was working with SentinelOne agents and they stopped that support. We were required to install a separate XDR client because Secureworks recently joined with Sophos and now wants us to install Sophos endpoint agents on our endpoints. That was a significant undertaking for us. From a financial perspective, SentinelOne was much more suitable for our organization. They offered us a very competitive proposal because we are among the top five SentinelOne customers in Saudi Arabia, and we are actually the first customer in Saudi Arabia. The POC was successful, so we proceeded with the implementation.

The most valuable aspect of SentinelOne Singularity AI SIEM is not actually the features themselves, but rather the integration capabilities with SentinelOne EDR. Previously, we were integrated with Secureworks, but now we are directly integrating with SentinelOne itself for AI SIEM, EDR, and NDR services. We have consolidated everything into one platform.

My impression of the AI-driven threat detection capabilities of SentinelOne Singularity AI SIEM is that it encompasses more than just AI-driven threat detection. We are integrating it with many devices and forwarding logs from multiple sources to SentinelOne Singularity AI SIEM. We are ingesting logs from Fortinet, other firewalls, other security products, and even from the cloud including Microsoft Office 365 and other security products.

SentinelOne Singularity AI SIEM has also been very stable.

There is room for improvement when it comes to the technical support quality and expertise of SentinelOne. Sometimes, the technical support team does not know how to resolve certain issues and takes time to respond, often requiring follow-up interactions within 24 hours.

SentinelOne Singularity AI SIEM can be improved in terms of support capabilities. Some logs from the server side need to be ingested. Secureworks was integrating with domain controllers and other systems, but SentinelOne still has some gaps. Some vendors cannot be integrated directly. For example, we are using Cisco Umbrella for DNS security, and we have to integrate it through an Amazon S3 bucket where we dump the logs and SentinelOne reads them from that location. For some Microsoft integrations, we must enable certain storage components and pay Microsoft directly to retrieve logs. There is no direct integration, so we must access the logs through that workaround. Previously with Secureworks, we had direct integration with Microsoft. Direct integration with Microsoft is not available now. SentinelOne needs to work on many product integrations to enable direct connectivity.

We implemented SentinelOne Singularity AI SIEM in February, and we have been using it for almost eight months now.

SentinelOne Singularity AI SIEM has been very stable.

SentinelOne Singularity AI SIEM's scalability in adapting to our organization's growing data and complex IT structures is flexible. We have not faced any scalability issues so far. Perhaps after one or two years we can discuss challenges we may have encountered, but as of now we have not faced anything related to scalability.

I would rate the technical support from SentinelOne as 8.5 out of ten.

We were using Secureworks before migrating to SentinelOne Singularity AI SIEM. My impression of the AI-driven threat detection capabilities is that SentinelOne Singularity AI SIEM encompasses more than just AI-driven threat detection. We are integrating it with many devices and forwarding logs from multiple sources to SentinelOne Singularity AI SIEM. We are ingesting logs from Fortinet, other firewalls, other security products, and even from the cloud including Microsoft Office 365 and other security products.

SentinelOne Singularity AI SIEM is deployed using a cloud-based SaaS model.

SentinelOne Singularity AI SIEM is used in our company.

When we took the service from SentinelOne, they provided an onboarding process with a dedicated engineer who helped us with all aspects of the implementation. A dedicated engineer from SentinelOne regularly contacts us, assists with configuration, and works with us on implementation details.

I find SentinelOne's pricing to be reasonable and competitive. We have taken SentinelOne Singularity AI SIEM along with the MDR service and also included ITDR (Identity Detection and Response) and EDR. They bundled all these services together and provided them to us as a single package.

SentinelOne offers a SOC service that handles our SOC operations. My impression of the AI-driven threat detection capabilities of SentinelOne Singularity AI SIEM is that it encompasses more than just AI-driven threat detection. We are integrating it with many devices and forwarding logs from multiple sources to SentinelOne Singularity AI SIEM. We are ingesting logs from Fortinet, other firewalls, other security products, and even from the cloud including Microsoft Office 365 and other security products.

We have used the automated workflow feature of SentinelOne Singularity AI SIEM and are still working on it. We started implementing automated workflows almost three months ago. The automated configuration is not a one-time setup, as we are continuously making changes and modifications over time.

I assess the overall security posture of our organization after implementing SentinelOne Singularity AI SIEM as significantly improved. We have developed a security posture that has definitely reached the benchmark. Previously, we were using Secureworks XDR, which is also a very good solution. We ran both solutions in parallel and discovered that Secureworks had almost a ten minute gap in identifying issues compared to SentinelOne, with a five to eight minute difference between the two platforms. The issue with Secureworks XDR is that it was not taking action because their playbooks were not efficient enough, partially because they were integrating with SentinelOne. In contrast, SentinelOne has local integration, so it immediately takes action and responds on the endpoint with automation. If any threat or suspicious activity is detected on any endpoint or server, SentinelOne immediately takes action at the same time. We have definitely increased our security posture.

I would rate SentinelOne Singularity AI SIEM overall as 8.5 out of ten. There are still certain things we are evaluating, so we maintain the rating of 8.5. I am basing this rating on three main factors: the quality of support, the frequency and quality of updates, and the integration and update capabilities. In terms of threat detection, response, and log collection, SentinelOne Singularity AI SIEM is excellent. We do not have any issues with those areas.

SentinelOne Singularity AI SIEM's AI-driven analytics have positively affected our SOC's ability to reduce false positives. We initially encountered false positives, but after configuration and adjustment, it performed much better for us. We now experience very low rates of false positives.

Consolidating multiple tools into SentinelOne Singularity AI SIEM has positively impacted our SOC's operational costs. We now manage our EDR, MDR, view logs, and handle automation all from one consolidated console from SentinelOne Singularity AI SIEM.

The consolidation has also reduced our SOC's operational costs and staffing needs. We are also taking SOC services from SentinelOne itself. SentinelOne has a dedicated SOC service that handles our SOC operations.

SentinelOne Singularity AI SIEM's scalability in adapting to our organization's growing data and complex IT structures is flexible. We have not faced any scalability issues so far. Perhaps after one or two years we can discuss challenges we may have encountered, but as of now we have not faced anything related to scalability.

We currently have five administrators managing this product, each with different roles and responsibilities. Within our structure, we have multiple entities, and we can create entity-wise administrators, which works very well for us.

More than 2,500 users in our company are using this product.

One issue we are facing is that SentinelOne's support team, as part of Amazon, works on updates on Sundays at the weekend. However, Sunday is the first working day for the Middle East region, particularly in Saudi Arabia. We have requested them to address tenant-related issues during our working hours. They are considering this request, and once Amazon establishes operations in Saudi Arabia, our tenant will be shifted to the kingdom and this issue will be resolved.

I would also like to mention the maintenance window for upgrades, which is an area that could be improved. My overall rating for SentinelOne Singularity AI SIEM is 8.5 out of ten.

Clients can use SentinelOne Singularity AI SIEM for endpoint security solutions, and apart from that, we currently have something called prompt security where it is helping us to enhance control over the AI prompts given by end-users. Some end-users tend to feed sensitive data to AI tools like Claude, Gemini, and ChatGPT. We have not implemented it yet, but we have provided a POC for agnostic prompt security.

AI-driven Threat Detection capability is crucial because attackers have started conducting attacks using AI patterns. They analyze the patterns of defending solutions, and based on the defense architecture, they generate the payload according to the environment. To detect those kinds of payloads, we need AI-based threat detection to sense whether they come from a single source or distinct sources, where these kinds of prompts and malicious payloads are being generated.

Real-time monitoring is a must-have functionality for any product, and SentinelOne Singularity AI SIEM has the same response. We can create rules for peculiar situations we encounter, and if those rules get triggered, the system can automatically help isolate or contain that system while providing us alerts at the same time. This way, if a particular user reports not being able to reach anything, we can quickly understand that SentinelOne Singularity AI SIEM has isolated their system.

With the help of this tool, the response time to sophisticated threats has improved significantly, and it recently cuts the MTTR time using Purple AI by 40%.

SentinelOne Singularity AI SIEM allows us to use natural language; we do not need knowledge of scripting or querying languages to correlate threats. We can search in normal, plain, simple English. For example, if I want to check the detections regarding a particular threat in a particular attack surface, I only need to provide it in plain, simple English, and Purple AI will generate a query and summarize the results for that. It has made my job much easier, both for myself and for the SOC teams. With minimal effort, we can get the queries asked by the auditors or forensics teams.

AI analytics reduces the manual tasks and helps us prioritize critical and immediate threats that need to be addressed. The analytical part mainly provides clarity on what we should focus on, which threats to investigate, or if we need to report it or whitelist false positives. These kinds of tasks are largely automated and taken care of.

Knowing which threat we need to look at first based on its criticality makes it easier for us to address it. Getting to the problem is one thing, and with Purple AI, we are able to get answers without using complex queries; we just search for what we are looking for, and it generates the corresponding steps right in the console, which helps us respond to critical threats on an immediate basis.

After implementing SentinelOne Singularity AI SIEM, we can see that we have visibility over all the applications on our endpoints, and it helps us identify which of those applications are more vulnerable or critical, whether high or medium. These kinds of visibilities are available, allowing us to proactively protect the endpoint and our infrastructure.

They could expand more integrations for other third-party products that are not currently available. Those are areas they can improve or have yet to improve.

For example, we have firewall integrations, so if we integrate our firewalls, we will be able to have a log view of the traffic. If traffic is coming from the firewall, we can see from which side a particular threat is coming. Currently, they support only FortiNet, Cisco, and Palo Alto. However, many of our clients use SonicWall firewalls, which are not in SentinelOne Singularity AI SIEM marketplace. They could add SonicWall because it is also a global product that needs to be included.

SentinelOne Singularity AI SIEM is pretty good compared to Charlotte AI from CrowdStrike. However, if it could provide more information on IOA, that would be beneficial. While SentinelOne Singularity AI SIEM does provide those details, leveraging that information to proactively check our systems for vulnerabilities would be better. In Charlotte AI, those functionalities are available. Therefore, the prompt can be improved, and provide more information on the attackers and attacks we are facing. Indicators of compromise are one thing, but IOA is another critical aspect that needs to be taken care of to help organizations proactively improve their cyber defenses against evolving attacks, as many attacks are happening globally. The same attacks may come to India or target our organization as well; thus improving on the IOA part would be beneficial.

I have been working with SentinelOne Singularity AI SIEM for around three to four years.

SentinelOne Singularity AI SIEM is 99% stable with no glitches as of now.

The product is pretty much scalable.

Customer support could be better. Customer support could be better because it is frequently transferred to various agents. This is just one particular case, and I do not want to elaborate further.

The deployment process with SentinelOne Singularity AI SIEM is somewhat complicated. Until some versions, we had scenarios where we needed to reboot machines, impacting deployment. However, with upgraded versions, we can now install the agent without any reboot, showing that they have improved that aspect.

For instance, if you are getting attacked and you use a brand other than SentinelOne Singularity AI SIEM, you will need to contact the OEM for recovery, which takes time. In contrast, with SentinelOne Singularity AI SIEM, we have a rollback option with just an automated click. If the data gets encrypted, it automatically rolls back. This functionality minimizes downtime and the impact of the attack. Looking at that perspective—post-attack damage control—the ROI is better. Using SentinelOne Singularity AI SIEM, data retrieval happens at a much faster rate, allowing production to continue without impact.

The automated workflow feature impacts my security tasks and manual efforts significantly.

Downtime is not necessarily required in scenarios where a particular system has to be isolated. Whether it is a server or a normal endpoint, if an application server faces downtime, the situation differs from a normal endpoint. If an application server needs to be contained, the customer will obviously experience downtime.

The consolidation of multiple tools with SentinelOne Singularity AI SIEM impacts SOC operations positively concerning cost and staffing needs. While I am unsure about staffing because it depends on daily occurrences, it definitely makes work easier for the team. For example, without it, a person can hardly handle two or three threats a day, but with SentinelOne Singularity AI SIEM, they can handle around 10 to 12 threats daily, which makes it much more efficient. SentinelOne Singularity AI SIEM is quite affordable. My overall review rating for this product is 9 out of 10.

We discuss with customers whether they want to go on a cloud or on-premises for the usual use cases of SentinelOne Singularity AI SIEM that I work with mostly. If a customer has a SentinelOne EDR, the EPS we do not count. The rest of the things we can integrate on a cloud.

Correlation, alerting, reporting, and helping with the AI-based alerts generated by the AI are the usual use cases. The parsing is already built into SentinelOne Singularity AI SIEM.

Detect undetected is a method for SentinelOne Singularity AI SIEM that I have found the most valuable so far. It can improve the true and reduce the false alerts and give a more granular report with a custom dashboard. Whatever the customer wants to see and however the customer wants to see it on the cloud-based SIEM. We can have the S3 bucket where we can manage the data retention from the customer side.

The automated workflow feature of SentinelOne Singularity AI SIEM is very good, which is not in the traditional SIEM. The next-gen is helping customers create multiple workflows, either automatically taking action in a SOAR kind of concept, and then you can create a playbook and multiple runbooks. The beauty of the integration is that it integrates very smoothly with third-party tools, so we do not need to think about the parsers, coding, depending on the codes, or the software developers. That is a good addition to SentinelOne Singularity AI SIEM.

I would want the false positive ratio to be lower and would want to improve that aspect so the true will be more, and the false will be lesser.

Other than false positives, the true will be increased and more focus should be on the OT security operations center. Now everything is on the cloud. Whenever OT security comes into the picture, the customers do not allow us to integrate their OT devices on a cloud. It should be available on-premises because the OT SIEM market, in the India market for instance, is something around a four to eight billion dollar market. Due to limitations on the cloud, we will not be able to configure with the OT SOC or the OT AI SOC.

I want SentinelOne to offer more on-premises integrations to focus on the OT SOC. It is one market which is an untouched market by the SentinelOne team. They have a very good SIEM, but it should be the target industry, the automobile, automotive, and then definitely IT is one of them. Everything is there with IT. The very good controls, integration, no parser requirements. But OT should also be the focus of the SentinelOne team.

I have been working with SentinelOne Singularity AI SIEM for about one and a half years.

I can rate SentinelOne Singularity AI SIEM a four out of five in terms of scalability in adapting to customer growing data and complex IT structures.

Four is because the product is beautiful, and the one reason why it is not a five out of five is because the capability of the SentinelOne pieces is not up to the mark.

It is scalable, and we can increase the compute size. It can scale. There are no challenges. It is good because it is on a cloud, so there is no problem with the scalability.

There are no challenges in handling growing data and complex IT structures because we create a log collector that is on AI. We build the VPN tunnel from all the locations. We pull in the logs. It is a pull and push mechanism. Things work fine. There is nothing critical these days.

The technical support of SentinelOne Singularity AI SIEM is very good, and we are getting support from them. Sometimes, whenever customization is required, they ask for PS. The team sometimes asks for professional services, which the customer does not agree to pay for.

Based on my experience with the technical support of SentinelOne Singularity AI SIEM, I would rate them a ten.

For one year they have been safely managing because they have replaced some of the competition with SentinelOne Singularity AI SIEM, including CrowdStrike.

We do participate in the initial setup of SentinelOne Singularity AI SIEM.

The usual setup process involves the log collectors and the cloud-based device. We create the VPN tunnel from the customer locations, and then we analyze the logs, create the alert, identify the incident, exposure management, and event search. It also works as a data lake, which is very good in SentinelOne Singularity AI SIEM. We have very good vulnerability management, which shows the beauty of the product.

There are no challenges with the initial setup because we have done multiple successful deployments.

The effect of SentinelOne Singularity AI SIEM on our customers' SOC efficiency in investigating alerts and responding to incidents is significant. We align our people, including L1, L2, and L3 engineers, for post-implementation, migration, reporting, alerting, correlations, and the behavior-based SIEM alerts. We align the people and discuss the ROI with the customers on SentinelOne Singularity AI SIEM.

For one year they have been safely managing because they have replaced some of the competition with SentinelOne Singularity AI SIEM, including CrowdStrike.

We do the red teaming to assess the real-time monitoring feature of SentinelOne Singularity AI SIEM. We check whether the real-time alerts are coming or not from the SIEM.

For one year they have been safely managing because they have replaced some of the competition with SentinelOne Singularity AI SIEM, including CrowdStrike.

Correlation, alerting, reporting, and helping with the AI-based alerts generated by the AI are the usual use cases. The parsing is already built into SentinelOne Singularity AI SIEM.

There is no challenge with operations because there are very good training portals where the people learn and perform the operation actively, and there is super training available on the SentinelOne portal through the SentinelOne Training University.

I provide this review with an overall rating of ten out of ten.

My main use case for SentinelOne Singularity AI SIEM is centralized log management, threat detection and correlation for incident investigation, automated response, cloud security monitoring, and endpoint plus SIM correlations.

My primary use case for SentinelOne Singularity AI SIEM is centralized security monitoring and incident investigation. I ingest logs from Microsoft Entra ID, Active Directory, Microsoft 365, firewall, VPNs, and SentinelOne EDR into the AI SIEM. Instead of checking each platform individually, I use SIEM to correlate events, identify suspicious activity, and investigate incidents from a single console.

The best features SentinelOne Singularity AI SIEM offers include centralized log management, AI-powered threat detection, Purple AI, AI Security Assistant, unified investigation timeline, and threat hunting. Hyper automation, fast search and investigation, cloud, and identity visibility are also standout features.

Out of those features, the centralized console is the one I find myself using the most, and it has made a big difference in my daily work.

SentinelOne Singularity AI SIEM has positively impacted my organization by improving visibility, reducing investigation time, and helping the security team respond to incidents faster.

Overall, SentinelOne Singularity AI SIEM is a strong platform, but there are a few areas where it could be improved. One area is customization. While it provides many built-in decorations and dashboards, creating highly customized decoration rules and reports can sometimes require additional efforts. Another area is third-party integrations. Although it integrates with many security products, expanding native integration and simplifying onboarding for less common vendors would make deployment easier.

From a usability perspective, I think the platform could make advanced investigation more intuitive. New analysts can face a learning curve when building complex searches, custom detection rules, or dashboards. Improving the user experience with more guided workflow templates and contextual recommendations would help teams become productive more quickly.

I have been using SentinelOne Singularity AI SIEM for about one year.

In my experience, SentinelOne Singularity AI SIEM has been a stable platform. It has been reliable for day-to-day SOC operations, including log ingestion, real-time monitoring, threat detection, and incident investigation.

In my experience, SentinelOne Singularity AI SIEM is highly scalable. As my organization grows, it is able to ingest and analyze logs for additional cloud services, identity providers, and network devices without requiring major changes to my security operations. This makes it well-suited for organizations with hybrid or multi-cloud environments.

I would rate the scalability of SentinelOne Singularity AI SIEM very high. It is designed to handle growing log volumes and supports environments that include on-premises infrastructure, cloud services, endpoints, identity platforms, and network devices.

My experience with the support has been very responsive and knowledgeable, particularly for technical issues and troubleshooting. I would rate the customer support eight out of ten.

I previously used another SIM solution. The main reason for moving to SentinelOne was to improve centralized visibility, simplify security options, and take advantage of AI-driven event correlations. With the previous solution, investigation often required switching between multiple tools and manually correlating events.

Overall, my experience with pricing, setup cost, and licensing has been positive. While SentinelOne Singularity AI SIEM is an enterprise-grade platform and not the lowest cost option, I think the pricing is reasonable considering the capabilities it provides. Features such as centralized log management, AI-driven analytics, automated workflow, and integrated security options can reduce operational overhead and improve SOC efficiency, which helps justify the investment.

I have seen a positive return on investment primarily through operational efficiency rather than reducing headcount. The biggest measurable benefit has been the reduction in investigation time. Before using SentinelOne Singularity AI SIEM, investigating a moderately complex alert took around thirty to sixty minutes because analysts had to collect logs from multiple security tools. With centralized log management and AI-driven correlation, I can often understand the scope of an incident in about ten to fifteen minutes.

Overall, my experience with pricing, setup cost, and licensing has been positive. While SentinelOne Singularity AI SIEM is an enterprise-grade platform and not the lowest cost option, I think the pricing is reasonable considering the capabilities it provides. Features such as centralized log management, AI-driven analytics, automated workflow, and integrated security options can reduce operational overhead and improve SOC efficiency, which helps justify the investment.

I considered other enterprise SIEM platforms such as Sentinel, Splunk, Enterprise Security, IBM, and Google Security Operations. I evaluated them based on integration with my existing environment, AI-assisted threat detection, scalability, ease of investigation, automation capabilities, and total cost of ownership. SentinelOne stood out because of its strong integration between EDR and AI SIEM, centralized visibility, and AI-driven event correlations.

My advice would be to spend time planning the deployment and identifying the log resources that provide the most value. SentinelOne Singularity AI SIEM is most effective when it is integrated with key systems such as Entra ID, 365, VPN, and endpoints. I would rate this product eight out of ten overall.

SentinelOne Singularity AI SIEM serves as our centralized platform for security data across our environments, enabling real-time threat detection and accelerated incident response. I use it to collect and analyze logs from endpoints, cloud workloads, identity providers, firewalls, and SaaS applications.

We initially used SentinelOne Singularity AI SIEM to identify and investigate a potential account compromise. The platform correlated unusual login activities from our identity provider, multiple authentication attempts, and suspicious PowerShell execution on an endpoint. Rather than having analysts manually check logs from different tools, the AI SIEM automatically connected these events into a single incident. This allowed our SOC team to quickly determine that the credentials were compromised and isolate the affected endpoint.

Our primary use case focuses on improving SOC efficiency by centralizing security telemetry and using AI to correlate alerts from endpoints, cloud identity, and network sources. Instead of investigating isolated alerts, analysts receive prioritized incidents with the full attack timeline. This helps reduce alert fatigue, speed up investigations, and enable faster response to threats such as phishing, credential compromise, and lateral movement.

The best feature is that it collects and correlates logs, which is very helpful. We also use it for AI-powered investigations. The platform provides unified visibility, AI-driven alert correlations, threat hunting, automated response, and AI-driven data pipelines. These are the features I found most valuable.

We have been using the AI-driven alert correlation feature extensively. Without AI-driven alert correlation, an employee clicking on a phishing email could exploit our entire organization. The AI automatically recognizes that all of these events are connected because they involve the same user, endpoint, and timeframe. We use it when somebody receives a phishing email or clicks a link, credentials are used from an unusual location, PowerShell is launched, connections are made to a malicious server, and persistence attempts occur. The correlation feature helps us identify and correlate these attacks, determine where the attack started, and find the threat so we can fix it.

The platform brings together AI, automation, and unified visibility in a way that helps security teams work more efficiently. Rather than switching between multiple tools and manually correlating alerts, analysts can investigate incidents from a single console with AI-assisted context. Features such as automated alert correlation, threat hunting, and response workflows help reduce investigation time and improve overall SOC productivity.

One of the biggest positive impacts has been improved operational efficiency for the security team. By centralizing telemetries from multiple sources and using AI to correlate related alerts, we have reduced the time spent on manual investigation. Analysts can focus on higher priority incidents. We have also noticed faster incident detection and response, better visibility across endpoints, cloud, and identity environments, as well as improved collaboration because everyone works from the same incident view.

Overall, SentinelOne Singularity AI SIEM is a very strong platform, but there are a few areas where I would like to see improvements. The AI-generated investigations can occasionally require manual validation for complex incidents. Increasing the precision and explainability of AI recommendations would be valuable. I would also appreciate even broader out-of-the-box integrations with third-party security tools and more pre-built detections and response playbooks. Additionally, making dashboards and reporting even more customizable would help organizations tailor the platform to different teams and executive reporting needs.

SentinelOne Singularity AI SIEM is a very strong platform, so I do not have much to suggest for improvement. Those are the main areas I would highlight. Overall, the platform is quite mature, and the improvements I would like to see are more about enhancing usability than addressing major shortcomings. Continued investigation into AI accuracy and explainability, additional native integrations with third-party tools, richer pre-built automation playbooks, and more flexible dashboards and reporting would be beneficial.

I have been working in this field for one year.

I have experienced no issues with SentinelOne Singularity AI SIEM. It is the best product I have ever used. The platform has been very stable in my experience. I have worked with it, and it is very handy, easy to manage, and excellent with its AI-driven capabilities.

From what I have seen, I have not personally encountered scalability issues, so I cannot point to any specific challenge in a production environment. As with any enterprise SIEM, the main considerations tend to be planning data ingestion, tuning detection rules to minimize noise, and integrating new data sources as the environment expands. Those are common operational considerations rather than unique limitations of the platform.

I have not reached out to customer support yet and have not experienced it directly. However, I have heard from my organization that their customer support is very good. Several of my colleagues have spoken with customer support, and their experience was great.

I have only worked with SentinelOne Singularity AI SIEM because I have recently started working. I have seven to eight months of experience, so I have never used any different solution.

My advice would be to plan the deployment carefully, integrate all relevant security data sources, and invest time in tuning detection and automation. SentinelOne Singularity AI SIEM delivers the most value when AI supports experienced analysts by reducing manual work and improving investigation speed rather than operating without human oversight.

My organization is currently a partner of SentinelOne.

I cannot provide verified metrics because I was not directly involved in measuring ROI, so I would not want to speculate. My experience is that the value comes from improved analyst productivity, faster investigations, and reduced operational overhead rather than a specific percentage of cost savings.

We actually had a great experience with pricing, setup cost, and licensing. I was not directly involved in pricing or contract negotiation, so I cannot comment on exact licensing costs. My understanding is that SentinelOne offers enterprise licensing based on factors such as the product selected, deployment size, and required capabilities. The platform appears to provide good value because it consolidates multiple security functions into a single platform.

I was not directly involved in the product evaluation or selection process, so I cannot accurately state which vendors were formally evaluated. In general, organizations looking at AI-powered SIEM solutions consider options such as Microsoft Sentinel, Google Security Operations, IBM, Falcon Next-Gen SIEM, and Microsoft Defender. However, I have not worked on those solutions, so I only have knowledge of SentinelOne Singularity AI SIEM.

AI-driven analytics can reduce false positives by providing better context and correlating related alerts into meaningful incidents. This helps analysts spend less time investigating false activity and more time responding to genuine threats.

My impression is that the AI-driven threat detection capabilities are one of the platform's key strengths. Overall, I have a positive impression. The AI-driven threat detection helps identify suspicious behavior, correlate related events into meaningful insights, and prioritize higher-risk threats. This enables analysts to investigate and respond more quickly while reducing alert fatigue. Human validation is still important, but the AI provides valuable decision support.

From my perspective, SentinelOne Singularity AI SIEM appears very suited for organizations with growing data volumes and increasingly complex IT environments. The visibility to ingest and correlate telemetry from endpoints, cloud workloads, identity systems, and third-party security tools provides a centralized view as the environment expands. Real-time monitoring impacts our threat identification process significantly.

Based on its capability, SentinelOne Singularity AI SIEM can improve SOC efficiency by correlating alerts, summarizing incidents, and helping analysts prioritize genuine threats. This reduces manual investigation and enables faster incident response while analysts still validate the AI's recommendations for critical decisions.

I think SentinelOne has taken a strong approach to AI governance and security. The platform uses AI to assist analysts with tasks such as alert correlation, investigations, and incident summarization while still allowing human analysts to validate findings before taking actions. From a governance perspective, having role-based access control, audit logs, and centralized visibility helps organizations maintain oversight. It is important to have clear governance policies, regularly review AI-generated recommendations, and ensure automated response workflows are appropriately validated.

Overall, I would rate the accuracy and reliability of the AI capabilities as good. The AI is effective at correlating related alerts, summarizing incidents, and helping analysts prioritize investigations, which can significantly reduce manual effort. However, AI outputs should not be treated as infallible, and for higher impact security decisions, it is still important for analysts to validate the AI findings and recommendations. I would rate this review as an eight out of ten overall.

I have been working with SentinelOne Singularity AI SIEM for four years.

The best features of SentinelOne Singularity AI SIEM include its user-friendly interface, ease of deployment, and ease of use. It is also easy to control the devices, as we block USB on all machines. You can export the configuration of machines and have very good visibility of the instance. The reports are excellent.

SentinelOne Singularity AI SIEM has impacted my organization positively and it was a very good solution.

SentinelOne Singularity AI SIEM can improve in the area of XDR, especially in the integration between SentinelOne and other solutions and components in the network, as it was not working well with the Fortinet firewall. The API and the integration between each other is not working well at this time, and they are promising to work on this area, but they have not done that effectively.

We did not face any downtime with SentinelOne Singularity AI SIEM.

SentinelOne Singularity AI SIEM is scalable in terms of adapting to my organization's growing data.

Around six to eight engineers were involved in the process of migration, working on this project.

I was personally involved in the project.

SentinelOne Singularity AI SIEM has impacted my operational costs positively, and I think we made a good deal with them because we are a big group and have a big account, so we got a good deal with SentinelOne.

The licensing cost for SentinelOne Singularity AI SIEM is a little bit high compared with the others, but it is worth it. It deserves the prices and is value for money; it is not very expensive according to the services that they are giving us.

For the implementation and deployment of SentinelOne Singularity AI SIEM for the whole solution, it takes about months as we made a migration from EDR to another for 3,000 users across Egypt and GCC, so it takes a lot of efforts.

I assess the efficiency of SentinelOne Singularity AI SIEM in improving my response time to sophisticated threats as very fast and very good.

For false positive incidents, SentinelOne Singularity AI SIEM manages these situations very well, and when we are facing someone uploading a false positive file, we can deal with these situations very well. You can easily go into the interface and mark this as a false positive, and I can recover the deleted or false positive files or anything like that.

AI-driven analytics of SentinelOne Singularity AI SIEM helped me to reduce false positives.

I assess the real-time monitoring feature of SentinelOne Singularity AI SIEM as very good and very responsive. Monitoring is working well, and it has a fast response to any threat; it does not take more than a few seconds to detect any threat and send a request for action. So it is very good.

For the automated workflow feature of SentinelOne Singularity AI SIEM, we did not try it.

I rate this product an 8 out of 10.

I am using SentinelOne Singularity AI SIEM as a customer only, and I have taken it very recently. I am using it to get visibility of investigating my alerts based on the alert events received from my endpoints. For AI-driven applications, I want to have end-to-end visibility, which is where the observability piece comes in. I am using it primarily for the AI part, as this product will cover my real-time data detections. I am planning on implementing it for my AI-driven applications.

AI-driven capabilities will give me real-time detection and will protect my autonomous AI interruption. We are using NLP language where my prompt engineer will upload some sensitive data. This can be detected and can protect my sensitive data from exfiltration. The AI-driven threat detection capabilities improve our overall security posture. By enabling the power of these capabilities, I can allocate my engineers or analysts in a more effective manner instead of allocating them on a day-to-day basis, which plays the major role.

I could see some workflows, but I am unable to do automated workflows. For example, some repetitive jobs or repetitive tasks I am doing, but I am trying to have less manual intervention on the front. I am raising some issues that should be resolvable. The SentinelOne team has told me that this can be resolved within a couple of months, but they are saying that it is in future for enhancement and it may take some time. So far, the numbers are great.

Regarding disadvantages or areas for improvement, I could say that 35 percent of my manual effort can be detected since I implemented it very recently. I could be able to say my current data talks about only 35 percent, and it may improve further, as I am expecting. But I can only comment based on my alerts and events. The adoption rate will be less compared to other products, as this can be a time-taken process because all my data needs to be offloaded and the system needs to understand my existing alerts, logs, and other things. This will take some more time, probably another month.

Another area for improvement is that the product is somewhat expensive. Pricing could be improved as well.

I have not experienced any incidents as of now. Regarding downtime, performance, and stability in general, my experience with the system downtime has been good.

SentinelOne Singularity AI SIEM is scalable in general. However, I carefully take the governance piece because it is an AI adoption and not a simple one. Protecting guardrails and getting visibility is a little challenging. I will carefully design our governance piece because with any AI adoption, the end goal should be more governance and data security and safety.

As of now, I have not faced many issues with technical support from SentinelOne. They are good. I would give eight out of ten for technical support because I am not sure how other solutions work, so I will take some time to fully evaluate.

Positive

My deployment was done with a partner and not in-house.

I have checked with Check Point and CrowdStrike when comparing competitors. This particular new AI era is new, and people are more focused on the AI part, but the outcome discussions are what matter. Because it is new technology, I do not have that much clarity on the costing front. However, this is not too expensive and it is not a white elephant. It is somewhere in the middle. If I take this trio of Check Point, SentinelOne, and CrowdStrike, SentinelOne is the most expensive among them.

All other products are having the same limitations. After every quarter or every release, they are also evolving. It is not only with SentinelOne. I have also checked with Fortinet and other products from Cisco.