SentinelOne Singularity Endpoint Reviews

My use cases for SentinelOne Singularity Complete are mainly for endpoint security to detect, prevent, and respond to cyber threats in real time. SentinelOne Singularity Complete serves as the first use case for endpoint security.

Our organization does not have the Ranger functionality because our customer does not require it.

We have integrated SentinelOne Singularity Complete with Shuffle SOAR technology, which is a most powerful tool.

Our organization is an MSSP provider with 10+ customers for whom we are providing security. We have 8,000 endpoints installed for our customers, and we are a 24/7 team providing security to our clients.

We have applied the protect policy and take basic analysis, which takes a couple of minutes before we raise the alert.

Regarding Purple AI, we are using it to identify the IOC. We have limited access to Purple AI, but we are using it for threat hunting purposes to find the IOCs.

What I like the most about SentinelOne Singularity Complete is the rollback capability for Windows systems. The TAC team and VSS rollback are the two features I appreciate most about SentinelOne Singularity Complete.

The response of the TAC team is very good. If SentinelOne Singularity Complete did not have a TAC team or support team, I would say it would be very lacking. When we get stuck anywhere, whether in any admin task or any threat hunting or investigation path, they are very helpful because there is a human voice on the other side helping us.

What I dislike about SentinelOne Singularity Complete is the high number of false positive alerts we get because our client sends us mail within one week stating that the CPU is highly utilized and resource consumption is high.

Regarding data privacy and security when using Purple AI, I can say that security-wise, it is good, though anyone can exploit that one.

I have been using SentinelOne Singularity Complete for two years.

Stability-wise, SentinelOne Singularity Complete is very good. It runs continuously, and if our endpoint is online, it will protect our endpoint 100 percent.

Regarding scalability, I heard that one of our competitor organizations deploys 15,000-plus endpoints for their customers. Scalability-wise, SentinelOne Singularity Complete is very good in that 15,000-plus endpoints are managed on one management console, which is double of our organization's deployment.

I have contacted the technical support or customer support, and this is the most significant reason we are using SentinelOne Singularity Complete. They are very helpful because there is a human voice on the other side helping us.

If you compare with CrowdStrike, our organization has shifted to SentinelOne Singularity Complete only because of that TAC team or support team.

We are using CrowdStrike, and in CrowdStrike, we are using Charlotte AI. If we raise a ticket on the community portal, within one or two hours, we get a reply from the team, and they are very helpful and can also come to the call. However, with CrowdStrike, I do not prefer it from my perspective as compared to SentinelOne Singularity Complete.

For the initial deployment of SentinelOne Singularity Complete, I can say that it is very easy. We just need to create one tenant for the SentinelOne Singularity Complete platform. SentinelOne Singularity Complete setup is very easy.

Maintenance is not actually required from my end because we are an MSSP provider, so no maintenance is necessary.

I can say that when an alert comes, we already have the protect policy and protect mode. After applying the protect policy, everything is taken care of by SentinelOne Singularity Complete.

I do not have knowledge about the pricing for SentinelOne Singularity Complete because our sales team handles that. SentinelOne Singularity Complete is very valuable to me.

I would give SentinelOne Singularity Complete a rating of 10 out of 10 because you can compare it with CrowdStrike, and I can say that SentinelOne Singularity Complete is top tier.

We are managing 7,000 to 8,000 endpoints for clients, and the setup is very easy. I have given SentinelOne Singularity Complete an overall review rating of 10 out of 10.

On-premises

Amazon Web Services (AWS)

I am currently working with SentinelOne products, specifically SentinelOne EDR and AI SIEM solutions. I have been working with SentinelOne Singularity Endpoint for the past nine months.

My use cases for SentinelOne Singularity Endpoint involve integrating multiple log sources from clients into a centralized platform. The platform has predefined rules, and I write custom rules based on threat hunts we are conducting. I analyze threats and alerts triggered by the platform to understand and respond to security incidents.

I work with the Ranger functionality for network and asset visibility in SentinelOne Singularity Endpoint.

SentinelOne Singularity Endpoint helps consolidate my security solutions in a different way than other products on the market. It offers new perspectives regarding threat fingerprinting and handling certain aspects of security. There are some limitations, but it is a growing product, and the team has made significant improvements since I joined, with new features continuously being developed.

The best aspect of SentinelOne Singularity Endpoint is its integration with AI, which provides initial analysis of alerts. It gives an overview of what the alert or threat is about and provides insight into what is happening.

SentinelOne Singularity Endpoint's ability to ingest and correlate across security solutions is valuable because it correlates data from the EDR module with custom rules I have defined. This correlation provides a complete overview of the incident and the overall capability.

SentinelOne Singularity Endpoint has helped me reduce alerts by correlating multiple data sources and grouping related alerts. This grouping makes it easier to investigate multiple incidents simultaneously.

SentinelOne Singularity Endpoint helps save time and free up my staff for other projects and tasks. It provides a brief description of each alert, which reduces investigation time so my team can focus on other priorities and increases overall productivity.

SentinelOne Singularity Endpoint has reduced my average MTDD and MTTR. The platform detects threats quickly, lowering the Mean Time to Detect, and provides brief alert descriptions that help close incidents faster, improving overall MTTR.

When retrieving results for logs in the AI SIEM of SentinelOne, there is a limitation where I can download up to 10,000 columns at a time, and the same constraint applies to vulnerability data. This product limitation needs improvement in future updates.

I would like to see these limitations removed in SentinelOne Singularity Endpoint. Additionally, the device control feature needs improvement. The EDR is solid, but there are several areas where the quality of work could be enhanced.

I have been using SentinelOne Singularity Endpoint for the past 9 months.

SentinelOne has not presented many stability issues. However, when searching for long-range queries, such as logs spanning three to four months, the platform sometimes takes extended time to retrieve the logs. Other than this, I have not encountered significant stability problems with the product.

I find SentinelOne Singularity Endpoint scalable.

I am aware of SentinelOne's tech support team. When I encounter agent issues, I create support cases, and the team usually provides a very good response with rapid turnaround. The support is available around the clock.

I have used other tools apart from SentinelOne, including CrowdStrike, Microsoft Sentinel, Microsoft Defender, and Carbon Black.

Having worked with tools like Defender and CrowdStrike, I can identify key differences in both pros and cons of SentinelOne. In Defender, you have limited information related to events, but in SentinelOne Singularity Endpoint, you have everything. When hunting on a specific device, you get all events including device events, network events, IP connections, and separate indicators to identify any indicators of compromise. SentinelOne has done significant work correlating these data points and keeping them separate so I can check each category independently while investigating alerts.

I am not certain how SentinelOne Singularity Endpoint was initially set up because the organization had been using it for the past five or six years before I recently joined them.

With new clients, I have not encountered many problems. From the EDR perspective, I did face some challenges related to SentinelOne Singularity AI SIEM where I had to find new ways of integrating all log sources, but I experienced nothing from the EDR perspective.

Purple AI plays a role in amplifying team knowledge and is quite effective in my environment. For example, when I receive an alert and want to see surrounding activities, if I am a person with no prior knowledge of SentinelOne Singularity Endpoint, building the query would be difficult to get new context and results. Purple AI helps by allowing me to provide a normal query or prompt, and it generates the query along with the results.

The key benefits from using SentinelOne Singularity Endpoint are that I have everything in a single platform. I have Ranger, the EDR module, AI SIEM, Purple AI to retrieve results, and vulnerability capabilities. I can correlate a single threat with all of these components to get a clear picture of what is happening in the environment.

I am using the SaaS deployment model for SentinelOne.

Ranger is important because it gives me visibility into how many devices in my network are unprotected. It provides security posture information showing how many detections exist, how many devices are protected, and how many are not. It gives an overview of what devices need protection and allows me to review why certain devices are not protected and identify any limitations.

The company name is SentinelOne.

I use Purple AI in SentinelOne.

Purple AI is an AI developed by SentinelOne that helps me correlate or build queries for those who have not used SentinelOne Singularity Endpoint before. It also provides information about the product without sharing confidential information. SentinelOne has a policy ensuring that all data and queries are kept internally and not shared with any third party.

Regarding workflow, Purple AI helps overall in my day-to-day operations by assisting with how alerts are triggered, retrieving results for alerts, providing alert descriptions from connected devices, and helping mitigate threats. I gave this review a rating of 8 out of 10.

As an integrator, my use cases are to reduce the attack surface and ensure that all endpoints, workstations, and servers are compliant with security standards. We have integration with the SOC as well, providing 24/7 monitoring. We serve a critical customer with many use cases.

In general, the solution helps to save time and free up staff for other projects and tasks. Approximately 15% of staff time is freed up. Regarding mean time to detect (MTTD), the solution also reduces MTTD by approximately 10%. As for mean time to respond (MTTR), this is something which is amazing, providing approximately a 20% reduction.

As an integrator, the biggest advantages of SentinelOne Singularity Endpoint that really stand out to me are that it supports on-premises deployment where we will not have to send the traffic back to the cloud. It only requires updates. This is why we selected it over CrowdStrike and other alternatives. EDR integration and memory protection to guard against attackers is valuable. It can detect lateral movement and other technical aspects.

Regarding the solution's ability to ingest and correlate across security solutions, we are approaching this differently. On the customer side, we have Splunk SIM (now owned by Cisco). We are ingesting all the traffic towards Splunk to have clear visibility from EDR. We are integrating with the SIM rather than the other way around.

Regarding alerts, SentinelOne Singularity Endpoint sometimes produces too many false positives, and sometimes produces true positives. We have to ensure that if there is an event flagged as a false positive, we have a layer two analyst conduct incident response investigation to verify whether it is a false positive or a real alert.

Regarding the Ranger functionality in SentinelOne Singularity Endpoint, I am not really working with this part. Regarding the AI part of the product, there is Purple AI for SentinelOne Singularity Endpoint. I am asking whether Purple AI is a separate product or included within SentinelOne Singularity Endpoint, or if it is a separate license product.

I have been using the solution for one year.

Regarding stability, I would say the product is approximately 95% stable. We first implemented it in detection mode (passive mode) and then transitioned to preventive mode.

Regarding scalability, I would say it is very easy to scale up and scale out. SentinelOne Singularity Endpoint is indeed scalable.

Regarding technical support from SentinelOne, my team is working on that aspect. They have not reported any issues so far. We have not opened any support cases yet. We are working with the local team on SentinelOne Singularity Endpoint for deployment, and they are doing the deployment work. Everything has gone smoothly because professional services are provided by the SentinelOne team.

We have on-premises deployments for the product.

The deployment itself is not easy because we operate in a very critical telecom environment. We have to manually install the product because we do not have Active Directory or patch management solutions yet. We have to select the servers and workstations manually and then perform manual installation on each. This takes considerable time for the installation process.

As an integrator, we are implementing the product.

Even though it is a security product, it is not possible to observe any return on investment yet. I have not conducted this analysis exercise yet.

Regarding pricing and licensing cost, I would say SentinelOne Singularity Endpoint pricing is medium.

When comparing solutions among themselves, the main reason for selecting SentinelOne Singularity Endpoint was because of on-premises deployment capability. CrowdStrike is an amazing solution, but it does not support on-premises deployment. It must be cloud-based through their Falcon service. Enterprises which have hybrid cloud environments and are using SASE solutions where all people are connecting from various locations rather than coming to the office would benefit more from CrowdStrike than SentinelOne Singularity Endpoint.

Summarizing everything that I have told you about the product, I can give SentinelOne Singularity Endpoint a rating of seven out of ten. Regarding deployment and stability to some extent, these areas could be improved. SentinelOne Singularity Endpoint should be able to provide integration with network detection and response (NDR). They should also be able to provide AI solutions built into the product rather than as a separate product. This is something that I am looking for.

We are working for SentinelOne Singularity Endpoint. We are using SentinelOne Singularity Endpoint for endpoint detection to detect any suspicious malware detected in any PDF or file that users download and access. SentinelOne Singularity Endpoint marks suspicious or malicious files and takes appropriate action by quarantining that file in real time. This is the basic purpose that we are using SentinelOne Singularity Endpoint for.

We have integrated SentinelOne Singularity Endpoint with third-party tools such as our ManageEngine ticketing portal and a few other security devices. It works very well and we have not faced any issues yet.

The foremost thing would be that the response is very fast, and capability-wise, it is highly capable. Its automated features, behavioral analysis, and machine learning features are numerous, and I feel SentinelOne Singularity Endpoint is best for these aspects.

SentinelOne Singularity Endpoint has a faster response, so the mean time to detect is remarkably better than other products. This has improved the overall productivity for our organization, which is a plus point using SentinelOne Singularity Endpoint.

Because it is fully automated, the moment any threat is detected on any file or system, that very second it marks the alert and takes appropriate automated action on it. If any manual human intervention is required, then we, the analysts, are responsible for drafting a mail to our client. This has overall reduced our manual effort significantly, making it very beneficial.

I feel that it can be much better. Initially, it creates a lot of false positive alerts, which can be improved. SentinelOne Singularity Endpoint does not have any custom dashboard feature, so adding that would be better for us. We could create our own customized dashboard rather than using the default dashboard that SentinelOne Singularity Endpoint has.

Regarding CPU utilization, in a few of our clients, we have observed that the disk usage and utilization gets very high because they have lots of endpoints integrated on that particular client. This can be improved in that scenario as well.

It has been a few months that I have been using SentinelOne Singularity Endpoint, and I have had a great experience with it.

As far as I am concerned, I have not seen any downtime in SentinelOne Singularity Endpoint. There has not been any scenario where we have to wait to see whenever the device gets back up and running. There has not been any issue on that.

It is very much scalable. SentinelOne Singularity Endpoint charges on a per-endpoint basis, so whatever the requirement is, it charges the client on that basis. We can scale up and scale down whenever we want. If we want to scale up to a higher endpoint, then it is very much easy to scale up and scale down.

There have been a number of scenarios where I have felt that this is not my area of expertise to manage. In those kinds of times, I have been connected with the OEM and the customer support team of SentinelOne Singularity Endpoint. These scenarios include when creating a new rule or finding out IOCs on a client's endpoint. I would rate the customer support a 10 out of 10 because their response was very quick, within a day.

I have not been aware of other EDR or XDR solutions. This is my first EDR endpoint detection response team, so I am not aware of what other vendors are providing.

From what I am aware of, the deployment is very easy. You just have to install SentinelOne Singularity Endpoint agent on the desktop, laptop, server, or whatever device it is. Before installing, we have to allow its IP address and port in the firewall for better services. After that, we have to install SentinelOne Singularity Endpoint on the desktop and laptop.

Our return on investment is very much high. Our company is basically an MSSP, and we are providing managed services to our clients. By using SentinelOne Singularity Endpoint and providing its features to our clients, our company makes a huge amount of money. It is a great return of investment for our organization.

What SentinelOne Singularity Endpoint is offering for the price range is very remarkable. They are pricing on the basis of per endpoint. They charge around six to ten dollars based on the required amount of endpoints that are necessary. At this price range, the type of solution we are getting is the best that we can ask for.

We have a dedicated threat hunting team for that kind of thing, so I have never been a part of that threat hunting procedure in our team.

The analytics bar allows us to view every threat that has been observed in whatever time frame it is. By seeing that, we can directly assess whatever threats that have been observed on any endpoints and take a particular action on that.

There has been a scenario when SentinelOne Singularity Endpoint automatically remediated a threat, but the client confirmed us that the file is genuine and necessary for them. During that time, we used the rollback feature to get it back to the original state. By doing that rollback, we can roll back to our default settings. For that purpose, we use the rollback feature.

The rollback feature has saved us quite a bit of time. Doing it manually would have taken much more time. By directly doing the rollback, it has saved us more than an hour of time.

Everyone should go for SentinelOne Singularity Endpoint because at the price range that they are offering their services, it is the best that we can ask for. Everyone should keep SentinelOne Singularity Endpoint as their security device for their firm or their own personal purpose as well. I would rate this review a 9 out of 10 overall.

I used SentinelOne Singularity Complete in the past and applied it to many customers in the Caribbean region. The use case was to implement SentinelOne Singularity Complete as a tool to replace the old antivirus systems that customers had. When we presented SentinelOne Singularity Complete, most customers appreciated it because the price was very competitive. They decided to provide this as a managed security service, which was very beneficial for them.

I appreciated the centralized dashboard that we used to manage the solution and the straightforward deployment process. We could deploy using Group Policy Objects to install the clients, which made the process very easy.

I loved the way that we could collect information and trigger actions when we identified a malicious file or a threat. Ranger was excellent for identifying other assets in the network that did not have the solution deployed, allowing us to create a map of the network. It was very important for us to identify workstations and servers that were not protected.

SentinelOne Singularity Complete reliably identifies real threats, which is a significant advantage as we could detect threats that other tools missed. The alerts are excellent for receiving notifications, and we could integrate with SIEM tools. This made it easy for us to create dashboards and see whenever we had an issue, and we could also create automations that could disconnect the device from the network or take other preventive measures to stop the spread of a virus.

I think dashboards could be improved with a dashboard creator feature that would allow us to select the information we want to extract and generate customized dashboards.

I worked with SentinelOne Singularity Complete for approximately three years.

SentinelOne Singularity Complete is very easy to deploy and implement.

SentinelOne Singularity Complete is very scalable for our needs.

Support was very good. When we needed assistance, we received it in a timely manner and the issues were resolved.

I worked with Defender and other tools including CrowdStrike, with particular experience managing CrowdStrike.

We implemented the complete solution in customer environments to integrate with their existing infrastructure.

SentinelOne Singularity Complete offers a very competitive price. When we implemented it, we could reduce costs with the total cost of ownership compared to other solutions.

When we presented SentinelOne Singularity Complete, most customers appreciated it because the price was very good. They decided to provide this as a managed security service, which was very beneficial for them.

When we implement SentinelOne Singularity Complete, we always create automations so that detection is very efficient in terms of timing. When we identified a threat, we could create rules to block the machine and put it in quarantine. This made it easy to investigate and we could have a broad overview of when the issue started, allowing us to manage issues in a shorter timeframe.

The mean time to respond was reduced in our security operations center. We used it to handle alerts and could act as soon as we received them. When we managed other vendors, it was time-consuming, but with SentinelOne Singularity Complete, it is much better.

Having a centralized tool like SentinelOne Singularity Complete allowed us to manage not only Windows desktops but also servers, MacBooks, and an entire environment. The integration with other SIEM tools is excellent, allowing us to create dashboards, analyze results, and receive alerts as soon as they are triggered.

At this point, SentinelOne Singularity Complete delivers everything it promises to do. We have deployed it from AWS and also created a tenant directly from the portal. SentinelOne Singularity Complete is easy to use, and the dashboards and portal are very user-friendly, which is why I prefer it. I would recommend that others try SentinelOne Singularity Complete because once they do, I believe they will love it. I would rate this review a 9 out of 10.

Public Cloud

Amazon Web Services (AWS)

I usually work with both the EDR and XDR use cases for SentinelOne Singularity Endpoint. I typically use it for working end-to-end on endpoint security.

The feature of SentinelOne Singularity Endpoint that I have found most valuable is the Rollback capability, which is exceptional. I find the Rollback valuable because if a machine gets affected by ransomware, you can perform a one-click Rollback on all machines to the previous state. This is important to me for data security.

SentinelOne Singularity Complete has helped customers consolidate their security stack by offering superb threat hunting, excellent incident response, and compliance monitoring in the EDR, with ransomware protection being exceptionally well supported by the Rollback feature. The behavior analytics in the tools are outstanding, providing granular reports and identifying abnormal users and activities while detecting previously undetected threats. This functionality is excellent in both the EDR and XDR of Singularity throughout the year.

My assessment of SentinelOne Singularity Endpoint's ability to ingest and correlate across security solutions is that the integration with the SIEM needs to be increasingly more robust. In terms of visibility, the endpoint and extended detection and response tools are excellent because of the EDR use cases covering malware infection, hash values, and the many zero-day attacks I can observe.

The Ranger functionality of SentinelOne Singularity Endpoint is valuable for understanding your environment, but I would want something integrated comparable to Mythos with all the features associated with Mythos. I would appreciate improvements to the technical support. I would prefer to see faster response times and quicker resolution from the technical support team of SentinelOne Singularity Endpoint.

I have been working with SentinelOne Singularity Endpoint for the last seven years.

When discussing communication with technical support, the pre-sales and sales teams are excellent, but the technical teams are not meeting the required standard, as issues often get stuck and problems are not resolved. I would rate the technical support a six out of ten.

The initial setup of SentinelOne Singularity Endpoint is very easy and not complex.

I have noticed time savings from Singularity Complete due to automation and end-to-end operation management, and the ROI is visible from the customer side. The ROI I have experienced is mainly related to vulnerability and attacks from hackers that lead to data breaches.

I have worked with Splunk, but it is not comparable to Elastic.

My core product is currently Elastic Security. SentinelOne Singularity Endpoint integrates with third-party tools very easily. Singularity Complete has been effective in reducing alerts. The reduction occurs because the number of true alerts is higher than false alerts, which provides greater visibility to customers and the environment, allowing for preventive and detective actions based on policies, procedures, and guidelines, with threat hunting focused on identifying threats and managing incidents through DFIR, breach management, and compromise assessment.

Regarding overall security, it is about managing the attack surface, securing data, brand, and organizations, as everything relates to compliance in data security. Overall security with tools including SASE, SOAR, SIEM, threat intelligence, and integrations with EDR and XDR is excellent. SentinelOne Singularity Endpoint has helped my customers reduce their organization's mean time to detect, as detection is a matter of seconds—improving from 40 seconds to 30 seconds in case of any attacks and altering mean time to respond depending on incident types such as P1, P2, P3, and P4.

Challenges can arise depending on the customer base, as the technical team must respond very quickly, especially since the post-sales team needs to have better quality than others to win the market. I participate in the initial setup of SentinelOne Singularity Endpoint as part of my regular tasks. I would rate this review a seven out of ten overall.

My usual use cases for SentinelOne Singularity Complete revolve around EDR and XDR, focusing on protecting end machines, including servers, particularly for users with critical applications running on endpoints. It is crucial for them to know how to protect those systems. If at any point phishing or an attack happens, I can provide data protection and restoration to my customers. Those are the primary use cases.

The feature I find most valuable in this solution is its rollback feature.

The rollback feature is incredibly valuable because if my organization gets hacked, I can restore complete data from up to half an hour back by clicking a one-click rollback option available in SentinelOne Singularity Complete.

SentinelOne Singularity Complete's ability to ingest and correlate across my security solutions is significant. It correlates with all other services, for instance with Netskope or Forcepoint. It also correlates with Proofpoint and many other endpoint machines like CyberArk, which is PIM/PAM, along with Netskope, Forcepoint, and Proofpoint, which involve DLP.

SentinelOne Singularity Complete helps me consolidate my security solutions overall, though the consolidation only happens at the endpoint level, not at all levels.

My impression of the Ranger functionality in SentinelOne is that it is a good product that is helpful for my AD environment. It effectively protects my AD machines in that environment.

In my experience, SentinelOne Singularity Complete helps reduce alerts significantly. If any machine comes up, I will receive a notification. So in a day, I might get a thousand emails or alerts. What Singularity does is filter those alerts and provide me with the top 10 or top 15 threats to understand and mitigate the risk. That is a lot of help from Singularity. The reduction in alerts has been around 60 to 70%.

SentinelOne is definitely improving, with a lot of new versions coming out and patches happening on a regular basis. They are acquiring a lot of AI companies and conducting R&D backend work, which is ongoing. By the end of this year, I believe a fully-fledged product will be available. One area needing enhancement is on the commercial front, especially considering the major competition with CrowdStrike. Hence, we must address some challenges, at least for the Indian market.

My experience with SentinelOne Singularity Complete spans four years.

I can rate how stable and reliable SentinelOne Singularity Complete is as a 9.

I can rate the scalability of SentinelOne Singularity Complete as a 10. Whether it is 50, 5,000, or 5 lakh endpoints, it remains scalable.

I do not often communicate directly with the technical support of SentinelOne, but my technical team does.

I would rate SentinelOne's technical support as an 8. Sometimes I get a response from them, but at times they may not have answers and defer to the engineering team, which can prolong the resolution time beyond expectations for customer satisfaction. Overall, it takes a couple of days longer than desired, but the rest of the service is good.

Positive

Before my experience with SentinelOne Singularity Complete, we worked with different technologies such as Trellix and Trend Micro.

I usually participate in the initial setup and deployment of SentinelOne Singularity Complete.

I can describe the initial setup process, but I am not deeply involved in the technical details because my technical team takes care of that. I am mainly focused on the business side.

From my perspective, the initial setup is straightforward. During a demo POC, they showcase the complete process, and the presentation along with the dashboard walkthrough helps the customer partner understand everything. It is not that complex.

SentinelOne Singularity Complete has positively impacted my company by being hassle-free. It provides good ROI, which stands for return on investment. It gives the best security, ensuring that if anything happens, I can utilize the rollback feature. Moreover, it offers a lot of integration scope with other solutions. The agent is so lightweight that it does not cause any system slowness when in use, making everything good.

The ROI I have experienced is straightforward. If I want to buy it for one year or three years, safeguarding it for three or five years down the line means my investment reduces. That is nothing but the ROI. Additionally, if I engage five engineers for this project and implement SentinelOne, then only one resource is needed to manage the dashboard and criticality alerts. This is how ROI materializes in my organization.

The decision to switch from the previous solutions was primarily driven by customer base comfort, customer adoption, and market responsiveness. Since SentinelOne is relatively new in India, having been around for five years, the customer adoption rate and ease of use made it easier for many customers to agree to replace Trellix, Trend Micro, and others. This led to a significant switch on their part.

SentinelOne Singularity Complete has definitely helped free up employees for other projects and tasks, both for me and for my customers.

SentinelOne Singularity Complete has greatly aided in reducing my mean time to detect. It is actually very fast because the agent works as an AI agent. It detects any kind of malicious activity or threat in a pretty fast way. It is very fast, and as it is an AI agent, it runs automatically, ensuring rapid detection.

Regarding the mean time to respond, my time is getting reduced by 80, 85, or even 90 percent, which is good.

When considering stability and reliability, if CrowdStrike can replace Trend Micro, then similarly, if SentinelOne can replace Trend Micro and Trellix, the same way CrowdStrike could potentially replace SentinelOne, indicating that the market remains highly flexible.

Based on everything I have described, I rate SentinelOne Singularity Complete as a 10 because I have to promote it, so I present it as my best product.

Public Cloud

Other

My main use case for SentinelOne Singularity Endpoint is the implementation inside of IT Brazil for around 100 users.

I use SentinelOne Singularity Endpoint day-to-day by having a team look at its platform to monitor our equipment and environment, and we also use it to block USB ports, which are the main uses here in Brazil.

Our team relies on SentinelOne Singularity Endpoint for both threat detection and response, though it does not happen very frequently. We keep our eyes on the application within the platform, and when it occurs, we connect SentinelOne Singularity Endpoint with our ITSM in the cloud.

SentinelOne Singularity Endpoint supports our operations as we are using the platform for control.

The best features that SentinelOne Singularity Endpoint offers include the ability to see the path of how malware contaminates equipment, allowing me to follow the entire path to mitigate problems.

This visibility helps my team by being very useful when we talk about threats; we can see the complete path from the start of a malware attempt, and we can run a remote search tool, making it very useful.

The API integration is very helpful for our platforms, including the ITSM I mentioned earlier, and I believe the API connection between platforms is very useful.

SentinelOne Singularity Endpoint has positively impacted my organization through the ease of use of the tool and the protection that it provides.

When I mention the protection that comes with using SentinelOne Singularity Endpoint, I find that the ease of detection is very fast in our platform, especially in our ITSM. We enter the SentinelOne Singularity Endpoint platform and search for anything related to malware directly on the computers, ensuring that nothing passes through SentinelOne Singularity Endpoint EDR.

Currently, I have nothing to suggest for improvements to SentinelOne Singularity Endpoint; we are very happy with the tool.

If I had to imagine one thing that could enhance my experience with SSentinelOne Singularity Endpoint, I would pick an easier way to view or follow the XDR platform, as I had some difficulties with it in the past.

I think that training would be beneficial for using the XDR, as we have a lot of information available there.

I have been using SentinelOne Singularity Endpoint for two years.

SentinelOne Singularity Endpoint is stable.

Scaling within SentinelOne Singularity Endpoint is very easy; if we acquire more licenses, the platform automatically distributes them to our equipment.

Customer support is very good; we opened a few tickets in the last month and received everything we needed from the support team.

We previously used Microsoft Defender and switched because it is not an advanced EDR, leading us to change to SentinelOne Singularity Endpoint.

Before selecting SentinelOne Singularity Endpoint, we evaluated other options such as Sophos and CrowdStrike, finding CrowdStrike to be very expensive and Sophos not meeting our requirements.

I believe we have seen a return on investment, particularly in terms of money saved compared to another tool.

My experience with pricing, setup cost, and licensing is good; the setup is very easy, and the license is per equipment, so it feels fair.

One noticeable benefit is that SentinelOne Singularity Endpoint is cheaper than other tools available in the market.

I do not have anything else to add about my main use case or how SentinelOne Singularity Endpoint fits into my workflow.

The unified platform experience certainly helps streamline our security operations, making things easier for my team.

In terms of adaptability to new and unknown threats, I believe SentinelOne Singularity Endpoint is the tool I have used the most, and while I cannot compare right now since I have only used CrowdStrike once, I find SentinelOne Singularity Endpoint easier to use than CrowdStrike.

I was not aware of the possibility to use an Offensive Security Engine, but I will seek more information on it.

Having built-in integrations that unify various aspects of cloud security is very significant for my team, as it makes everything easier to manage.

I advise others looking into SentinelOne Singularity Endpoint to check the ease of usage of the tool, as the platform is very helpful and the protection it provides is truly exceptional. I have given this review a rating of 10.

Public Cloud

Microsoft Azure

My usual use cases for SentinelOne Singularity Endpoint are to manage and deploy it on the endpoints across my organization. I also use it for automations, which represents my primary use case.

I use SentinelOne Singularity Endpoint mostly with my EDR. I am not heavily focused on cloud at this time as I am still in the development and learning phase of cloud deployment and cloud telemetry collection. Seeing alerts on a single pane of glass and resolving incidents has helped me significantly. It provides a better ecosystem with the AI team and all the capabilities already included.

The EDR feature of SentinelOne Singularity Endpoint and their detection features are excellent. They perform very well at endpoint detection and resolution. Their automated response capability is equally strong. There is also granular control over endpoint detection policies, which is valuable.

I have integrated SentinelOne Singularity Endpoint with Splunk, and the ingestion and correlation of logs and telemetry from endpoints is strong. It provides a good perspective on what exactly happened. This really helps me as a SOC analyst to investigate what has occurred on an endpoint if there is malware or a malfunction on that particular endpoint.

SentinelOne Singularity Endpoint has reduced the overhead of my alerts with the enhanced telemetry provided. I do not have a precise count, but it has had a significant impact. I estimate that I experience approximately twenty to thirty percent less alert overhead as they are automatically enriched and resolved.

SentinelOne Singularity Endpoint has helped reduce my team's time in analyzing alerts and determining what is wrong with endpoints. It also makes investigations easier without disrupting users. Mean time to detect and mean time to respond are metrics where I cannot provide exact numbers, but I can say that SentinelOne Singularity Endpoint has had a noticeable positive impact, making detection and response much faster than the very manual and tedious process we had before.

The positive benefits from using SentinelOne Singularity Endpoint include reduced effort required to interact with users during critical investigations. It has provided automation capabilities and advanced telemetry from endpoints to investigate any issues that arise. My team interacts less directly with users, so the impact to user business is minimized when cyber incidents occur and investigations are needed.

They could still work on optimizing their agent. Additionally, they do not appear to provide a free trial. If they could provide a free trial for one or two endpoints, it would be a better option for testing.

I worked with SentinelOne Singularity Endpoint at Infosys for two years and have continued using it recently, for a total of approximately three years.

SentinelOne Singularity Endpoint is reliable and stable. It does not create many issues.

I measure the stability and reliability of SentinelOne Singularity Endpoint based on how well it detects threats and how stably it performs in user environments. I do not want an EDR tool or agent to consume excessive resources from the endpoint. SentinelOne Singularity Endpoint manages this well. It would be better if it were more optimized, but overall it performs well.

SentinelOne Singularity Endpoint is scalable and easy to scale. We simply deploy it and it scales itself.

Scaling out might be a concern, but I have not had a need to scale down, so this has not been an issue.

I am not currently in touch with technical support for SentinelOne Singularity Endpoint as I am in the early deployment phase and am learning and brushing up on the platform myself. My peers have had interactions with technical support, and they have reported that it is excellent. Technical support is overall very strong, and though I do not have direct contact with them, the feedback I have received has been positive.

I previously used Quick Heal Endpoint and Quick Heal EPS, which were not sufficient for our advanced threat protection needs. We switched to SentinelOne Singularity Endpoint because of these limitations.

SentinelOne Singularity Endpoint is fairly straightforward to set up and has an intuitive user interface. A clear vision of your security policies is necessary, and a phased rollout is recommended. You cannot roll out the solution to everyone at once as it might impact many people simultaneously. A phased approach with policies tailored to your organization works best.

The cost of SentinelOne Singularity Endpoint is reasonable and appropriate for the features it provides. It is not too expensive or cumbersome. However, it would be beneficial if they could provide a free trial at some point.

I was considering Trend Micro Vision One as an alternative option, but SentinelOne Singularity Endpoint stood out.

I was evaluating Trend Micro Vision One and determined that SentinelOne Singularity Endpoint was the better option for my use case with one of my particular clients. As a consultant at a service-based firm, my role is to advise organizations on what will suit them best. For that particular client, this was the optimal choice, though other clients might benefit from different options. SentinelOne Singularity Endpoint was one of my top considerations for endpoint security along with Microsoft Defender for Endpoint for Windows-only environments.

SentinelOne Singularity Endpoint is a SaaS-based platform that I deployed on-premises. I would rate this solution a ten out of ten.

SentinelOne Singularity Endpoint is used for endpoint security to detect, prevent, and respond to cyber threats in real time. Using AI-based behavior analysis, it helps the SOC team to investigate incidents, automate responses and actions, and protect systems from malware and ransomware. SentinelOne Singularity Endpoint includes EDR, XDR, and NGAV.

A favorite feature of mine about SentinelOne Singularity Endpoint is the VSS rollback feature, which is most valuable. If a laptop is infected with any malware, there is an option to rollback files and recover them from before the attack happened.

Using SentinelOne Singularity Endpoint has helped me reduce alerts because it is integrated with FortiSIEM, one of the leading SIEM tools, and with SOAR technology. Whenever alerts come on SentinelOne Singularity Endpoint, they are directly raised to SOAR technology automatically. This is an automatic tool, so manual interaction is not required. All work is done by SentinelOne Singularity Endpoint, and I only have to take action on the analyst's verdict to determine if it is a true positive or false positive and investigate accordingly.

Dislikes include high false-positive alerts and resource consumption issues with CPU and disk usage.

Ranger functionality is for network discovery and control features. Its primary role is to identify and manage unmanaged devices on the network by detecting rogue devices in detections. It ingests logs from network sources and captures threat metrics, including IOCs. However, I cannot confirm if SentinelOne Singularity Endpoint releases the alert through Ranger, as I have not worked heavily on this feature because the Ranger functionality license is not available. SentinelOne Singularity Endpoint captures different telemetry from network devices.

I have been using SentinelOne Singularity Endpoint for 2.3 years in my career.

Everything is perfect with SentinelOne Singularity Endpoint. There are no stability problems, and the system is very reliable and hands-on.

SentinelOne Singularity Endpoint is very good in scalability. Scalability is extremely easy to achieve as new endpoints and new detection points come on board. The system can scale any number of times, and only the license for each endpoint is needed.

Whenever I get stuck on any alert with SentinelOne Singularity Endpoint and do not understand it, or when I face any admin task challenges, I manually open a ticket with the customer team. Every time they help regarding the case. Each day, if I get stuck anywhere in SentinelOne Singularity Endpoint, whether with any admin task or threat hunting, the tech team or support team will surely help.

For the support team of SentinelOne Singularity Endpoint, I would rate them nine out of ten because there is a human voice there, so they are listening and responsive.

For the first two years in my organization, I used Symantec AV. After that, I changed my domain to SentinelOne Singularity Endpoint.

The initial deployment of SentinelOne Singularity Endpoint is easy and very straightforward. All that is needed is to set up a tenant and create a package file. Once installed, it automatically connects to the management console, and the entire system can be set up in one or two hours.

For one customer of SentinelOne Singularity Endpoint, one to two people are enough for deployment. Because we are a partner with SentinelOne and have many customers, one to two members are sufficient for each customer deployment.

I do not have knowledge about the pricing of SentinelOne Singularity Endpoint, as the sales team handles that. However, based on my knowledge, SentinelOne Singularity Endpoint is very flexible in its pricing range at approximately $9 to $10 per endpoint. We have 5,000+ endpoints because we are an MSSP provider, making it cost-effective.

I would choose SentinelOne Singularity Endpoint. In Symantec AV, there is only signature-based and behavior-based threat detection, whereas SentinelOne Singularity Endpoint has advanced behavior AI and pre-static AI. In Symantec AV, alerts must be manually raised and actions taken on the endpoint, but SentinelOne Singularity Endpoint has fully automated AI. The use cases are moderate in Symantec AV, but SentinelOne Singularity Endpoint is very easy with a modern UI. I prefer SentinelOne Singularity Endpoint because I have worked with both.

The mean time to detect with SentinelOne Singularity Endpoint is very low. The mean time to respond for SentinelOne Singularity Endpoint is approximately two to three minutes since it is integrated with SOAR, and alerts are raised within that timeframe. From endpoint to console, alerts are received in real time with no lagging. SentinelOne Singularity Endpoint requires no maintenance. Since we have a partnership with the SentinelOne Singularity Endpoint team and are an MSSP provider, no maintenance is required. My overall rating for this review is eight out of ten.

On-premises

Other