SentinelOne Singularity Identity and Cortex XSIAM compete in the cybersecurity software category. SentinelOne appears to have the upper hand due to its efficiency in direct endpoint management and its strong AI capabilities.
Features: SentinelOne Singularity Identity excels in behavior-based threat detection, offers lightweight agents that don't burden system resources, and provides excellent threat visibility via its AI capabilities. Cortex XSIAM is noted for its unified solution approach, leveraging machine learning for threat detection, and solid integration capabilities across complex environments.
Room for Improvement: SentinelOne could enhance endpoint management, improve web filtering capabilities, and increase customer support responsiveness, with more precise policies for individual endpoints management. Cortex XSIAM requires better performance optimization, broader integration support to top its complex environments, and an improved developer-friendly approach compared to its competitors.
Ease of Deployment and Customer Service: SentinelOne is available both on-premises and in the public cloud, offering 24/7 support with a customer-centric approach. Cortex XSIAM receives positive ratings for support, though enhancements in first-level support are needed.
Pricing and ROI: SentinelOne Singularity Identity provides competitive pricing, considered cost-effective compared to CrowdStrike, despite concerns over yearly price hikes. Its ROI is viewed positively due to its comprehensive protection. Cortex XSIAM, while perceived as expensive, meets budget expectations and offers good value, with ROI depending heavily on the services and features selected.
With premium support, core Palo Alto technical experts handle issues directly.
It is ineffective in terms of responding to basic queries and addressing future requirements.
The Palo Alto support team is fully responsive and helpful.
They have been responsive to our needs as integrators and those of the client.
Without proper integration, scaling up with more servers is meaningless.
Cortex XSIAM is highly scalable.
The product was easy to install and set up and worked right.
Overall, Cortex XSIAM is stable.
Cortex XSIAM is on the expensive side and requires substantial improvement in pricing.
Obtaining validation for integrations from Palo Alto takes around eight months, which is quite long.
Cortex XSIAM needs improvements in terms of data onboarding, parsers, and third-party integration supports.
There is a clear roadmap for improvements, including enhancing capabilities with AI and seamless functionality in an MSP model for deeper visibility across multiple agencies.
Cortex XSIAM is pretty expensive, and the licensing process is not very comfortable.
The first impression is that XSIAM would be more expensive than others we tried.
The product is very expensive.
The advanced visualization capabilities of the product are important for understanding security trends in an organization.
Cortex XSIAM allows us to onboard almost every device, whether they are on-prem or on SaaS.
The flexibility for creating manual workflows stands out.
With visibility into endpoint telemetry, SentinelOne does provide useful information to find threat actors and empowers those who are in the business of threat hunting.
| Product | Market Share (%) |
|---|---|
| SentinelOne Singularity Identity | 5.0% |
| Cortex XSIAM | 5.5% |
| Other | 89.5% |
| Company Size | Count |
|---|---|
| Small Business | 9 |
| Midsize Enterprise | 2 |
| Large Enterprise | 3 |
| Company Size | Count |
|---|---|
| Small Business | 4 |
| Midsize Enterprise | 5 |
| Large Enterprise | 13 |
Cortex XSIAM acts as a critical element for SOC foundations, integrating SIEM and EDR capabilities, valued for threat detection and seamless security orchestration with Palo Alto Networks products.
Organizations find Cortex XSIAM beneficial for SOC foundations due to its capability to integrate SIEM and EDR tools, facilitating data collection, detection, and response. It connects with third-party data sources while reducing management effort and offering cost-effective alternatives to competitors like CrowdStrike and Trend Micro. Featuring automation and integration with Palo Alto Networks products, Cortex XSIAM enhances threat detection. Unified architecture allows a comprehensive view of attacks, further supported by machine learning and integration with existing vendor solutions, ensuring that users gain insights without significant manual log analysis.
What are Cortex XSIAM's key features?
What benefits are evident in Cortex XSIAM reviews?
Industries implement Cortex XSIAM mainly in technology-driven sectors where centralized endpoint protection and automation of forensic investigation are paramount. By integrating several third-party systems for incident response, companies in competitive markets leverage its attributes for heightened operational security efficiency. However, users note areas for improvement, such as Attack Surface Management and integration enhancements, to better suit tech-heavy industries needing extensive connectivity with cybersecurity solutions.
Singularity Identity, a component of the Singularity platform, provides threat detection & response (ITDR) capabilities to defend Active Directory and domain-joined endpoints in real-time from adversaries aiming to gain persistent, elevated privilege and move covertly. Singularity Identity provides actionable, high-fidelity insight as attacks emerge from managed and unmanaged devices. It detects identity misuse and reconnaissance activity happening within endpoint processes targeting critical domain servers, service accounts, local credentials, local data, network data, and cloud data. On-agent cloaking and deception techniques slow the adversary down while providing situational awareness and halting adversarial attempts at lateral movement. Singularity Identity helps you detect and respond to identity-based attacks, providing early warning while misdirecting them away from production assets.
Singularity Identity’s primary use case is to protect credential data and disrupt identity-based attacks. The most valuable function of Singularity Identity is its ability to misdirect attackers by providing deceptive data to identity-based recon attacks. Additionally, it can hide and deny access to locally stored credentials or identity data on Active Directory domain controllers.
Singularity Identity also provides rapid detection and respond to identity attacks, capturing attack activity and feeding it directly to the Singularity platform’s Security DataLake for enterprise-wide analysis and response.
By implementing Singularity Identity, organizations benefit from enhanced security, reduced credential-related risks, and improved user productivity. It detects and responds to identity-based attacks, ensuring only authorized individuals can access critical identity data. With its cloaking capabilities to hide identity stored locally on endpoints or in the identity infrastructure and it’s ability to provide decoy results to identity-based attacks, organizations can effectively secure their sensitive or privileged identities, resulting in improved overall identity security.
We monitor all Identity Threat Detection and Response (ITDR) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.
