No more typing reviews! Try our Samantha, our new voice AI agent.

SentinelOne Singularity AI SIEM vs SentinelOne Singularity Endpoint comparison

 

Comparison Buyer's Guide

Executive SummaryUpdated on Apr 9, 2026

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

SentinelOne Singularity AI ...
Ranking in AI Observability
8th
Average Rating
8.6
Reviews Sentiment
6.1
Number of Reviews
5
Ranking in other categories
Security Information and Event Management (SIEM) (14th)
SentinelOne Singularity End...
Ranking in AI Observability
4th
Average Rating
8.8
Reviews Sentiment
7.2
Number of Reviews
227
Ranking in other categories
Endpoint Protection Platform (EPP) (3rd), Anti-Malware Tools (2nd), Endpoint Detection and Response (EDR) (2nd), Extended Detection and Response (XDR) (2nd)
 

Featured Reviews

Prince Joseph - PeerSpot reviewer
Group Chief Information Officer at NeST Information Technologies Pvt Ltd
Advanced AI-driven monitoring has strengthened investigations and now prioritizes critical threats
I would not say there is anything that could be better in SentinelOne Singularity AI SIEM; I think we have seen something unique in the product. This product has the potential to add more SOC functionality on top of its SIEM, which can automate a few more things because I have the information there. I need to do what I would call security agents or agentic AI to be built on top; it can take care of a lot more analysis and actions. Maybe licensing cost can also be looked at and reduced. We are still to see the automated feature work a little bit more; we are not really using it to the full extent.
Vaibhav Mahendra Kolhe - PeerSpot reviewer
Soc Analyst at Softcell Technologies Limited
Automation has reduced alerts and freed the soc team to focus on faster incident response
Regarding mean time to respond, the improvements I see with SentinelOne Singularity Complete are that genuine files also get alerts. We are getting false positives, but we are also getting genuine true positive alerts. The improvement will be deep visibility because as I am using Splunk as a SIEM, I compare deep visibility with Splunk, but deep visibility has limited access with only a 14-day policy to retain logs. The improvement will be in overall policy management. The third point will be the complexity of policies. If we want some endpoints to use only USB or if we need to block USB on some points, the policy management is very complex. The fourth point will be that Mac OS and Linux don't have the rollback policy; that policy is only for Windows. These four points are improvements if SentinelOne Singularity Complete can address them. Data privacy and security when utilizing Purple AI is crucial for SentinelOne Singularity Complete, and SentinelOne Singularity Complete lacks in data security. Data security is very important in this world. In my organization, if we deploy SentinelOne Singularity Complete and we have integrated all the firewalls, all devices, and AWS devices to SentinelOne Singularity Complete, logs will be forwarded to SentinelOne Singularity Complete through SentinelOne Singularity Complete. However, SentinelOne Singularity Complete doesn't have data security solutions such as Forcepoint DLP or 48 layer; SentinelOne Singularity Complete doesn't have that DLP solution. From the data security point of view, SentinelOne Singularity Complete is not good.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"SentinelOne Singularity AI SIEM's AI-powered analytics does affect our SOC's ability to reduce false positives; that is one of the biggest advantages because the manpower that I have is limited."
"After using SentinelOne Singularity AI SIEM, it has reduced our incident response time by forty to fifty percent compared to other tools."
"Overall, I would assess the overall security posture after implementing SentinelOne Singularity AI SIEM as significantly better."
"When they face attacks such as ransomware and are dissatisfied with their existing solutions, they switch to SentinelOne Singularity AI SIEM, which is quite good in detecting unknown threats, cleaning the system, and handling ransomware."
"AI-driven capabilities will give me real-time detection and will protect my autonomous AI interruption."
"SentinelOne’s Rollback is its best feature."
"The single pane of glass is probably the most valuable. That is a big one. We could see everything from one view."
"The ability to get queries by pressing the "tab" button is a plus for SentinelOne."
"The main benefits the end-user gets from Singularity Platform are, first, the program itself being very small, and then we get better output from applications running on their systems."
"I really like the storyline feature."
"It recently stopped a ransomware attack at one of my clients, proving its reliability."
"We have absolutely seen a return on our investment because it has created that first-level SOC, replaced McAfee and other tools, and they keep adding features that further increase the value we get."
"The web portal has a really good web UI, and all the things are well integrated."
 

Cons

"Another area for improvement is that the product is somewhat expensive. Pricing could be improved as well."
"In AI SIEM, the areas that have room for improvement are the parsers for third-party integrated data or for third-party data sources that are not native integrations, which could be made a bit easier."
"At the moment, I feel the pricing is a little bit on the higher side, but the tool is positioned in a place where risk is very high, and we do not want to take chances, so we are prepared to pay the premium."
"SentinelOne Singularity AI SIEM has some performance and reliability issues that need improvement."
"It is quite good, but the only downside is that it is costly."
"Interoperability with other SentinelOne solutions and other third-party tools is an area where you can run into some issues. Because of the way the agent works, there are sometimes things that are blocked or prevented from happening that are not identified as a threat, and therefore, not alerted in the console. Sometimes, we do have to dig through the logs, run tests, and adjust the whitelisting or exclusions to make sure that other applications will run properly."
"The agent update schedule is a little sporadic, and the updates are frequent."
"A weakness seen with one large customer was that the detections were too intrusive, blocking many applications that should have been working, which led to many false positives."
"As a cloud-based product, there is a minimum number of licenses that need to be purchased, which is unfortunate."
"In terms of improvement, I would like to see better alerting to let us know if there is anything wrong with SentinelOne working on the endpoint of the computer."
"We ran into production issues related to CPU utilization on Linux endpoints. Our production environment's performance got degraded like anything."
"The update process can be better. It is very easy to deploy, but over a long period, the updating process can be a little messy. In some EDR solutions, you end up with a very good mechanism to push new versions. It could do with a little work in that area. It is not particularly difficult, but it could do with a little work."
"The MDM functionality and maturity still need improvement."
 

Pricing and Cost Advice

Information not available
"SentinelOne Singularity Complete is reasonably priced."
"I do not know much about the pricing. What I do know is that the person who negotiates most of the pricing is quite a hard bargainer. In that regard, he often says that he managed to get a very good deal. When we first looked at replacing our old system with Singularity Complete, its price was definitely a big factor. Back then, Singularity Complete was fairly new to the marketplace. We got quite a good deal as an early adopter. They have honored that and respected that we were an early adopter, and I feel we are still getting a very good price."
"The solution's pricing is not too bad for what it's offering, like the documentation that comes with it."
"The pricing was very similar in terms of its competitors, but I believe SentinelOne's capability and willingness to attract new business allowed us to save some extra money."
"It's around $8 per client per month."
"I can pay, for my environment, between $30,000 and $40,000 a year, and that's a pretty good deal."
"I believe the retail pricing, or MSRP, is a bit high."
"For our use case, the solution is affordable. There are not any hidden fees."
report
Use our free recommendation engine to learn which Security Information and Event Management (SIEM) solutions are best for your needs.
886,174 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Construction Company
9%
Healthcare Company
9%
Comms Service Provider
8%
Financial Services Firm
7%
Computer Software Company
11%
Manufacturing Company
8%
Financial Services Firm
8%
Government
6%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
No data available
By reviewers
Company SizeCount
Small Business104
Midsize Enterprise51
Large Enterprise79
 

Questions from the Community

What needs improvement with SentinelOne Singularity AI SIEM?
In AI SIEM, the areas that have room for improvement are the parsers for third-party integrated data or for third-party data sources that are not native integrations, which could be made a bit easi...
What is your primary use case for SentinelOne Singularity AI SIEM?
Our use case with SentinelOne Singularity AI SIEM is primarily AI observability for a large part. We are using it for SIEM purposes as well. Prior to the inclusion of Purple AI, it was exclusively ...
What advice do you have for others considering SentinelOne Singularity AI SIEM?
My impression of the AI-driven threat detection capabilities of SentinelOne Singularity AI SIEM is great. I am really looking forward to the upcoming feature with agentic incident investigation. If...
Cortex XDR by Palo Alto vs. Sentinel One
Cortex XDR by Palo Alto vs. SentinelOne SentinelOne offers very detailed specifics with regard to risks or attacks. The ability to reverse damage caused by ransomware with minimal interruptions to...
Which is better - SentinelOne or Darktrace?
Which solution is better depends on which is more suitable specifically for your company. Darktrace, for example, is meant for smaller to medium-sized businesses. It is also a good option for organ...
 

Also Known As

No data available
Sentinel Labs, SentinelOne Singularity, Singularity Platform
 

Overview

 

Sample Customers

Information Not Available
Havas, Flex, Estee Lauder, McKesson, Norfolk Southern, JetBlue, Norwegian airlines, TGI Friday, AVX, Fim Bank
Find out what your peers are saying about SentinelOne Singularity AI SIEM vs. SentinelOne Singularity Endpoint and other solutions. Updated: March 2026.
886,174 professionals have used our research since 2012.