Devo vs SentinelOne Singularity AI SIEM comparison

Devo and SentinelOne are both solutions in the Security Information and Event Management (SIEM) category. Devo is ranked #26 with an average rating of 8.0, while SentinelOne is ranked #14 with an average rating of 8.6. Devo holds a 1.2% mindshare in SIEM, compared to SentinelOne’s 1.4% mindshare. Additionally, 95% of Devo users are willing to recommend the solution, compared to 100% of SentinelOne users who would recommend it.

Devo

Read 23 Devo reviews

5,226 Views
3,031 Comparison Views

95% willing to recommend

SentinelOne Singularity AI ...

Read 5 SentinelOne Singularity AI SIEM reviews

2,933 Views
2,288 Comparison Views

100% willing to recommend

Devo

SentinelOne Singularity AI ...

Comparison Buyer's Guide

Download the report

Executive SummaryUpdated on Mar 29, 2026

Devo and SentinelOne Singularity AI SIEM are competing products in the SIEM landscape. SentinelOne appears to have the upper hand due to its advanced threat detection capabilities.

Features: Devo specializes in high-speed search, multi-tenant architecture, and real-time analytics. SentinelOne stands out with its sophisticated behavioral AI, automated threat hunting, and extensive endpoint protection.

Room for Improvement: Devo requires improvement in user interface customization, scaling advanced analytics, and enhancing native integrations. SentinelOne could improve the onboarding processes, reduce initial setup costs, and enhance reporting flexibility.

Ease of Deployment and Customer Service: Devo offers a cloud-native architecture for simplified deployment and responsive customer support. SentinelOne provides streamlined deployment with strong AI model training and extensive utilization resources.

Pricing and ROI: Devo is praised for its competitive pricing and cost-effectiveness, offering a strong ROI. SentinelOne, while more costly initially, leverages advanced features for long-term gains, appealing to organizations prioritizing top-tier security.

To learn more, read our detailed Devo vs. SentinelOne Singularity AI SIEM Report (Updated: April 2026).

Buyer's Guide

Devo vs. SentinelOne Singularity AI SIEM

April 2026

Download the complete report

Helped 894,738 peers since 2012

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Categories and Ranking

Devo

Ranking in Security Information and Event Management (SIEM)

26th

Average Rating

8.4

Reviews Sentiment

6.8

Number of Reviews

Ranking in other categories

Log Management (27th), IT Operations Analytics (7th), AIOps (19th)

SentinelOne Singularity AI ...

Ranking in Security Information and Event Management (SIEM)

14th

Average Rating

8.6

Reviews Sentiment

6.1

Number of Reviews

Ranking in other categories

AI Observability (12th)

Mindshare comparison

As of May 2026, in the Security Information and Event Management (SIEM) category, the mindshare of Devo is 1.2%, up from 1.0% compared to the previous year. The mindshare of SentinelOne Singularity AI SIEM is 1.4%, up from 0.4% compared to the previous year. It is calculated based on PeerSpot user engagement data.

Security Information and Event Management (SIEM) Mindshare Distribution
Product	Mindshare (%)
SentinelOne Singularity AI SIEM	1.4%
Devo	1.2%
Other	97.4%

Security Information and Event Management (SIEM)

Featured Reviews

Francisco JavierRomo

Strategic Account Executive at a computer software company with 51-200 employees

Has improved investigative workflows with interactive dashboards and simplified data correlation

The data analytics cloud component focuses on real-time analytics, which is very impressive. The SIEM collects and correlates logs data from different sources and can integrate with ServiceNow, hardware asset management, and software asset management. The security orchestration, automation, and response (SOAR) is another valuable feature. The security data platform serves as the foundation of Devo. Regarding advanced query capabilities, Devo offers several models including query logs, visual query builder, language integrated query, and SQL, with SQL being the most frequently used querying data capability. The single pane of glass that Devo offers is the SOC. The tools in Devo's active ports are for investigating, not just viewing data. They are more interactive than other market solutions. The drill-down reports capabilities allow analysts to click on any element in a widget. When they see a spike in a line chart for a failed login, which could be a true or false attempt, they can click that spike, and a table widget on the same active board instantly populates with raw logs of data for those specific failed logins. This is particularly important for enterprise companies with numerous endpoints and users. The dynamic filtering of inputs significantly reduces the time cybersecurity analysts spend trying to figure out failed logins and identifying false positives.

Read full review

Mohan Janarthanan

Associate Vice President at Novac Technology Solutions

AI-driven monitoring has improved real-time threat detection but still needs better automation

I could see some workflows, but I am unable to do automated workflows. For example, some repetitive jobs or repetitive tasks I am doing, but I am trying to have less manual intervention on the front. I am raising some issues that should be resolvable. The SentinelOne team has told me that this can be resolved within a couple of months, but they are saying that it is in future for enhancement and it may take some time. So far, the numbers are great. Regarding disadvantages or areas for improvement, I could say that 35 percent of my manual effort can be detected since I implemented it very recently. I could be able to say my current data talks about only 35 percent, and it may improve further, as I am expecting. But I can only comment based on my alerts and events. The adoption rate will be less compared to other products, as this can be a time-taken process because all my data needs to be offloaded and the system needs to understand my existing alerts, logs, and other things. This will take some more time, probably another month. Another area for improvement is that the product is somewhat expensive. Pricing could be improved as well.

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"We can ingest virtually any log source, which is much better than our previous solution."

"Being able to build and modify dashboards on the fly with Activeboards streamlines my analyst time because my analysts aren't doing it across spreadsheets or five different tools to try to build a timeline out themselves. They can just ingest it all, build a timeline out across all the logging, and all the different information sources in one dashboard. So, it's a huge time saver. It also has the accuracy of being able to look at all those data sources in one view. The log analysis, which would take 40 hours, we can probably get through it in about five to eight hours using Devo."

"The ROI has been great as we could launch it in a few months instead of a couple of years, and when you put all the costs together, it is less to have done it than with the open source approach."

"It's a core tool for us in looking at logs, because logs are the starting point in any investigation, so leveraging Devo from start to finish in any investigation is basically what we do."

"Overall, using Devo has saved us time when compared to our previous security solutions, and I estimate that it took us 10 times longer to achieve the same thing without Devo."

"It is a joy to partner and be able to work with this kind of system."

"The most powerful feature is the way the data is stored and extracted. The data is always stored in its original format and you can normalize the data after it has been stored."

"Devo has a really good website for creating custom configurations."

More Devo pros

"Overall, I would assess the overall security posture after implementing SentinelOne Singularity AI SIEM as significantly better."

"SentinelOne Singularity AI SIEM's AI-powered analytics does affect our SOC's ability to reduce false positives; that is one of the biggest advantages because the manpower that I have is limited."

"AI-driven capabilities will give me real-time detection and will protect my autonomous AI interruption."

"After using SentinelOne Singularity AI SIEM, it has reduced our incident response time by forty to fifty percent compared to other tools."

"When they face attacks such as ransomware and are dissatisfied with their existing solutions, they switch to SentinelOne Singularity AI SIEM, which is quite good in detecting unknown threats, cleaning the system, and handling ransomware."

Cons

"Some of the documentation could be improved a little bit. A lot of times it doesn't go as deep into some of the critical issues you might run into. They've been really good to shore us up with support, but some of the documentation could be a little bit better."

"The overall performance of extraction could be a lot faster, but that's a common problem in this space in general. Also, the stock or default alerting and detecting options could definitely be broader and more all-encompassing. The fact that they're not is why we had to write all our own alerts."

"An admin who is trying to audit user activity usually cannot go beyond a day in the UI. I would like to have access to pages and pages of that data, going back as far as the storage we have, so I could look at every command or search or deletion or anything that a user has run. As an admin, that would really help. Going back just a day in the UI is not going to help, and that means I have to find a different way to do that."

"The tools in Devo's active ports need enhancement in their investigative capabilities."

"My opinion on the solution's technical support is not as great as it could be because of the issues I have faced regarding the service management element."

"The biggest area with room for improvement in Devo is the Security Operations module that just isn't there yet. That goes back to building out how they're going to do content and larger correlation and aggregation of data across multiple things, as well as natively ingesting CTI to create rule sets."

"Some of the documentation could be improved a little bit. A lot of times it doesn't go as deep into some of the critical issues you might run into."

More Devo cons

"It is quite good, but the only downside is that it is costly."

"SentinelOne Singularity AI SIEM has some performance and reliability issues that need improvement."

"In AI SIEM, the areas that have room for improvement are the parsers for third-party integrated data or for third-party data sources that are not native integrations, which could be made a bit easier."

"Another area for improvement is that the product is somewhat expensive. Pricing could be improved as well."

"At the moment, I feel the pricing is a little bit on the higher side, but the tool is positioned in a place where risk is very high, and we do not want to take chances, so we are prepared to pay the premium."

Pricing and Cost Advice

"Devo is definitely cheaper than Splunk. There's no doubt about that. The value from Devo is good. It's definitely more valuable to me than QRadar or LogRhythm or any of the old, traditional SIEMs."

"I'm not involved in the financial aspect, but I think the licensing costs are similar to other solutions. If all the solutions have a similar cost, Devo provides more for the money."

"Pricing is based on the number of gigabytes of ingestion by volume, and it's on a 30-day average. If you go over one day, that's not a big deal as long as the average is what you expected it to be."

"Be cautious of metadata inclusion for log types in pricing, as there are some "gotchas" with that."

"Devo was very cost-competitive... Devo did come with that 400 days of hot data, and that was not the case with other products."

"The way Devo prices things is based on the amount of data, and I wish the tiers had more granularity. Maybe at this point they do, but when we first negotiated with them, there were only three or four tiers."

"We have an OEM agreement with Devo. It is very similar to the standard licensing agreement because we are charged in the same way as any other customer, e.g., we use the backroom."

"Devo is a hosted or subscription-based solution, whereas before, we purchased QRadar, so we owned it and just had to pay a maintenance fee. We've encountered this with some other products, too, where we went over to subscription-based. Our thought process is that with subscription based, the provider hosts and maintains the tool, and it's offsite. That comes with some additional fees, but we were able to convince our upper management it was worth the price. We used to pay under 10k a year for maintenance, and now we're paying ten times that. It was a relatively tough sell to our management, but I wonder if we have a choice anymore; this is where the market is."

More Devo pricing and cost advice

Information not available

See which vendors are best for you

Use our free recommendation engine to learn which Security Information and Event Management (SIEM) solutions are best for your needs.

See recommendations

894,738 professionals have used our research since 2012.

Top Industries

By visitors reading reviews

Financial Services Firm

13%

Construction Company

Computer Software Company

Outsourcing Company

Construction Company

Outsourcing Company

Comms Service Provider

Healthcare Company

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

By reviewers
Company Size	Count
Small Business	8
Midsize Enterprise	4
Large Enterprise	11

By reviewers
Company Size	Count
Small Business	3
Midsize Enterprise	2
Large Enterprise	2

Questions from the Community

What is your experience regarding pricing and costs for Devo?

Compared to Splunk or SentinelOne, it is really expensive. I rate the product’s pricing a nine out of ten, where one is cheap and ten is expensive.

See all answers

What needs improvement with Devo?

The single pane of glass that Devo offers could be improved. The tools in Devo's active ports need enhancement in their investigative capabilities. The drill-down reports capabilities, while useful...

See all answers

What is your primary use case for Devo?

During my time at MetaBase Q and as a partner integrator of ServiceNow, I had the chance to understand and be part of projects integrating SOCs, NOCs, and Security Operation Centers with Devo. Most...

See all answers

What needs improvement with SentinelOne Singularity AI SIEM?

I would not say there is anything that could be better in SentinelOne Singularity AI SIEM; I think we have seen something unique in the product. This product has the potential to add more SOC funct...

See all answers

What is your primary use case for SentinelOne Singularity AI SIEM?

For us, the use case is primarily to analyze security events that are coming in and also events that are kept over a period of time, to track and use it for investigation and maybe analysis, someti...

See all answers

What advice do you have for others considering SentinelOne Singularity AI SIEM?

I assess the overall security posture of the company after implementation as positive; I see a big impact on that. I would rate this review as an overall eight.

See all answers

Comparisons

LogRhythm SIEM vs Devo

Compared 9% of the time

Splunk Enterprise Security vs Devo

Compared 7% of the time

New Relic vs Devo

Compared 4% of the time

IBM Security QRadar vs Devo

Compared 3% of the time

Microsoft Sentinel vs Devo

Compared 3% of the time

More Devo Competitors

Microsoft Sentinel vs SentinelOne Singularity AI SIEM

Compared 24% of the time

Fortinet FortiSIEM vs SentinelOne Singularity AI SIEM

Compared 15% of the time

Huntress Managed SIEM vs SentinelOne Singularity AI SIEM

Compared 7% of the time

Huntress Managed EDR vs SentinelOne Singularity AI SIEM

Compared 5% of the time

Wazuh vs SentinelOne Singularity AI SIEM

Compared 4% of the time

More SentinelOne Singularity AI SIEM Competitors

Product Reports

Buyer's Guide

Devo

May 2026

Download Devo product report

Buyer's Guide

SentinelOne Singularity AI SIEM

April 2026

Download SentinelOne Singularity AI SIEM product report

Overview

Devo offers powerful visual analytics, real-time data querying, and log integration capabilities within a cloud-native, multi-tenant architecture, supporting extended data retention ideal for long-term analysis and compliance.

Devo is recognized for its Activeboards, which facilitate visual analytics. High-speed search capabilities and real-time analytics enable efficient data manipulation and querying. Its multi-tenant architecture supports effective data segregation and customization tailored to distinct business needs, enhancing its value for handling complex log integrations. With extended data retention of 400 days and a cloud-native architecture, Devo is a robust platform for long-term analysis and compliance requirements. Though opportunities exist to improve browser stability on large searches, SOAR integrations, and its parser capabilities, Devo remains essential for incident response and security monitoring, offering centralized data storage and analysis.

What are Devo's most important features?

Activeboards: Facilitate visual analytics and data exploration.
High-Speed Search: Enables fast data querying and manipulation.
Real-Time Analytics: Supports instant insights and decision-making.
Multi-Tenant Architecture: Allows effective data segregation and customization.
Extended Data Retention: Offers 400-day log retention for compliance and analysis.
Complex Log Integration: Handles intricate data sources effortlessly.

What benefits and ROI should organizations look for in reviews?

Visual Insights: Enhance understanding through interactive dashboards.
Performance Efficiency: Saves time with high-speed data search and real-time results.
Customization Flexibility: Fits specific business requirements with multi-tenant architecture.
Long-Term Compliance: Ensures alignment with extended data retention needs.
Centralized Monitoring: Enables comprehensive incident response and security monitoring.

Devo is extensively used in industries focused on incident response and digital forensics, centralizing data for security monitoring across hybrid environments. Organizations benefit from its ability to store and analyze aggregated logs, creating alerts and dashboards to enhance visibility for network and endpoint activities in multi-domain settings.

Devo

SentinelOne Singularity AI SIEM offers comprehensive security information and incident management designed to enhance threat detection, response, and investigation capabilities within enterprise environments.

SentinelOne Singularity AI SIEM is known for its robust capabilities in the realm of cybersecurity, providing organizations with an advanced tool to combat modern threats. The platform integrates machine learning and artificial intelligence to automate threat identification and streamline incident response processes. Its intuitive interface allows teams to manage security events efficiently, ensuring rapid reaction to potential vulnerabilities. As a scalable tool, it adapts to evolving security demands, providing valuable insights to safeguard critical business operations.

What are the important features of SentinelOne Singularity AI SIEM?

Automated Threat Detection: Uses AI to identify threats with minimal human intervention.
Comprehensive Data Analysis: Capable of processing extensive security-related data for informed decision-making.
Real-time Monitoring: Continuously tracks events for immediate alerts on suspicious activities.
Scalability: Adapts to the changing needs of enterprises, maintaining effectiveness at any scale.
Seamless Integration: Easily connects with existing security infrastructure to enhance overall protection.

What are the key benefits or ROI from SentinelOne Singularity AI SIEM?

Improved Security Posture: Enhances the ability to detect and respond to complex threats, minimizing risks.
Operational Efficiency: Automates routine processes, allowing security teams to focus on strategic tasks.
Cost-effectiveness: Reduces the need for extensive manual analysis, cutting down operational costs.
Business Continuity: Protects critical operations from disruptions, ensuring uninterrupted service delivery.
Scalability and Flexibility: Ensures ongoing adaptability to growing and dynamic security demands.

In industries such as finance and healthcare, implementation of SentinelOne Singularity AI SIEM often means tailored solutions to protect sensitive data, meeting regulatory compliance. These sectors appreciate its capability to provide detailed insights and reduce the risk of data breaches, thus preserving stakeholder trust.

SentinelOne

Sample Customers

United States Air Force, Rubrik, SentinelOne, Critical Start, NHL, Panda Security, Telefonica, CaixaBank, OpenText, IGT, OneMain Financial, SurveyMonkey, FanDuel, H&R Block, Ulta Beauty, Manulife, Moneylion, Chime Bank, Magna International, American Express Global Business Travel

Information Not Available

Buyer's Guide

Devo vs. SentinelOne Singularity AI SIEM

April 2026

Free Report: Devo vs. SentinelOne Singularity AI SIEM

Find out what your peers are saying about Devo vs. SentinelOne Singularity AI SIEM and other solutions. Updated: April 2026.

DOWNLOAD NOW

894,738 professionals have used our research since 2012.

See our Devo vs. SentinelOne Singularity AI SIEM report.

See our list of best Security Information and Event Management (SIEM) vendors.

We monitor all Security Information and Event Management (SIEM) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.