SentinelOne Singularity Endpoint Reviews

SentinelOne Singularity Endpoint serves as my primary tool for Endpoint Detection and Response (EDR). I do not use the XDR function of SentinelOne Singularity Endpoint. I use it exclusively as an EDR, and this EDR integrates seamlessly with our SIEM solutions. We have SIEM tools in place such as Splunk and QRadar, and SentinelOne Singularity Endpoint integrates with both of them perfectly, providing valuable inputs. The metadata that it fetches is useful for our security operations.

I find the functions and features in SentinelOne Singularity Endpoint very useful; their detections are precise. They are very accurate and do not produce a lot of false positives, which we experience from other EDR tools. That is their unique selling proposition. Furthermore, I believe SentinelOne Singularity Endpoint is the only EDR that provides on-premise deployment. Even CrowdStrike and Microsoft are entirely SaaS-based and cloud-based.

SentinelOne Singularity Endpoint helps reduce the number of alerts. As I mentioned earlier, it generates precise alerts with very few false positives, if any, so the number of alerts it generates has actually reduced the load on our SOC analysts.

SentinelOne Singularity Endpoint does help free up my staff. I support approximately 18,000 to 20,000 endpoints with only two EDR engineers. This is a significant reduction from when we had multiple EDR admins. SentinelOne Singularity Endpoint is very easy to manage from an administration and maintenance perspective. Management is straightforward and simple.

SentinelOne Singularity Endpoint helps reduce mean time to detect (MTTD).

We are not working with SentinelOne Complete to consolidate our security solutions in one place.

If SentinelOne could localize the Purple AI and other features for larger environments such as ours, which has around 20,000 endpoints, that would be an improvement. If they could provide a local LLM that can be installed on-premise, it would be easier for us. Otherwise, we need to obtain government permissions, which is quite complex and can take years. A local version of the LLMs for Purple AI would be beneficial.

I believe that SentinelOne's technical support needs to improve slightly. They are quite slow, and while I understand they might be busy, I would rate them at a seven out of ten.

I have been using SentinelOne Singularity Endpoint for more than two years.

For the stability of SentinelOne Singularity Endpoint, I would rate it at eight or even nine because I have not experienced any downtime.

I would rate the scalability of SentinelOne Singularity Endpoint at nine.

In comparison to products such as Splunk and QRadar, their support is swift and quick.

Previously, we had solutions that were inferior to SentinelOne Singularity Endpoint, which demonstrates an improvement, but they can still do better.

SentinelOne Singularity Endpoint has a simple and straightforward initial setup process.

We purchase our licenses for SentinelOne Singularity Endpoint from a local distributor, not through the marketplaces or directly from SentinelOne.

SentinelOne Singularity Endpoint provides benefits such as saving money as it is very light on the endpoint. It uses between 150 to 250 MB of RAM when booted up and drops down to 100-150 MB. It is not resource-hungry, and the laptops work fine. We do not have to upgrade the RAM of all employee laptops. In comparison, other EDRs such as Microsoft Defender are quite resource-hungry, and employees often complain about laptop speed, but we do not face those issues.

I would rate the pricing for SentinelOne Singularity Endpoint at around four out of ten.

If I could choose between CrowdStrike and SentinelOne Singularity Endpoint without considering pricing, I would still choose SentinelOne Singularity Endpoint because I have not had a negative experience with them. In contrast, CrowdStrike has a reputation for causing issues.

I do recommend SentinelOne Singularity Endpoint to other users as part of my day-to-day responsibilities. I have given this review an overall rating of eight out of ten.

SentinelOne Singularity Complete is being used comprehensively for all capabilities. It is being used for endpoint detection and response, and for XDR purposes. For example, Entra data is being ingested into the platform to get a more complete picture, and also for non-incident-based threat hunting.

The ability to ingest and correlate across various security solutions is impressive. It could be a bit more widespread, but fortunately it is using OCP, and the built-in Purple AI understands more and more of it. On a scale of one to ten, I would rate this a seven to eight.

SentinelOne Singularity Complete has helped me and my clients consolidate security solutions absolutely. I have clients who are no longer using old school SIEMs and they have moved everything into SentinelOne. It has been replacing old AV or non-performative EDR solutions.

The best features in SentinelOne Singularity Complete have to be Purple AI. SentinelOne has not been doing AI for only the past three years, but they have done it since they started. They do have a more realistic grasp on their technology. Using Purple AI, it is very easy to quickly get a grasp on your data, to get the data that you want, and get it properly formatted.

Writing the parsers for data ingestion can be a bit annoying in SentinelOne Singularity Complete. When you do not have a native integration, parsing to OCP or OCF can be a bit tedious. Nothing major aside from that data ingestion aspect.

I have been using SentinelOne Singularity Complete since 2020.

I would rate the technical support for SentinelOne Singularity Complete a nine.

Positive

The deployment process for SentinelOne Singularity Complete is easy. The documentation for it is really well-made. I might have overengineered it a bit to always automatically deploy the latest version via the API, making it perhaps more complicated than it needs to be, but once you have it set up, you do not need to worry about it again.

The initial deployment for SentinelOne Singularity Complete depends on the size of the customer, but usually half a day for full deployment is very doable.

I still work with SentinelOne Singularity Complete as well. I am partnered with SentinelOne.

I absolutely use SentinelOne Singularity Complete's Ranger functionality. It is awesome to get a quick grasp on shadow IT, to know what you really have in your environment and what you perhaps do not even know about, what is covered, and what is not covered. The quick rollout feature or the deployment feature via Ranger is differentiated. In my opinion, when you see a device not having SentinelOne Singularity Complete in the Ranger overview, that indicates an issue with the process. You can use the band-aid by quickly deploying it, but in my opinion, that is a band-aid and you need to look at the process first.

It is hard to put into numbers how much SentinelOne Singularity Complete has helped reduce alerts. If it was just a percentage, I would have to say 90% and above. SentinelOne Singularity Complete correlates alerts. If something is happening in the same general incident, it is added to that incident rather than being a new alert. I remember being in the rollout for a larger client and they had another solution still in place at the time. They were running simultaneously for a while. In their old solution, they got hundreds and hundreds of alerts for a single occurrence, 99% of which were false positives. In SentinelOne Singularity Complete, we had a single notification, a single alert, making it much easier to quickly work through and finish.

Regarding my false positive rate reduction, I would say roughly 80%.

SentinelOne Singularity Complete absolutely saves time for me and my clients.

In numbers, I would say 80%. It is a lot of automation, and you can trust in the product to pretty much work. After you have set it up, you can essentially leave it running until you get an alert. That can mean you can leave it alone for a couple of weeks, and that is completely fine.

I would say roughly 70% for how much it has helped reduce my mean time to respond. Getting the alert is only half the benefit. Being able to quickly get all the information you need and then make an appropriate decision is simplified so much. Going back to the topic of XDR, because you can integrate pretty much any data you want into the console. You do not have to have 20 different tabs open. You can have SentinelOne Singularity Complete open and that is it. You can have all the information right there, even within the threat page itself. That simplifies things so much.

So 70% for detection and 70% for response.

Regarding Purple AI, data privacy and security when utilizing AI are important, and it meets my requirements and needs. Every time I interact with someone who is not from Germany, it is always the topic of data security and privacy for Germans. I think Germans are a bit different on that topic. Purple really does meet all the criteria for that. There has never been a single complaint.

With Purple AI, I would assess the capabilities in providing synthesized threat intelligence or contextual insight at six to seven out of 10. There is room for improvement. In a lot of cases, it might just be seeing issues where there potentially are none. If you look at a single event, for example, it may give you the information that this might be threat-related, but when you look into the data, it might also not be. Generally, it does perform really well and if there is something definitely malicious in an event, it will tell you. There is room for improvement.

SentinelOne Singularity Complete helps streamline threat investigations by making it so easy. It is actually unbelievable. Anyone can get started. For example, I recently introduced a new apprentice to the threat hunting capabilities via Purple AI, and that same day he was able to use it because the barrier to entry is so low. You do not need to learn a new query language. You do not need to learn the syntax. You can get right to it and get started.

In my thoughts on pricing for SentinelOne Singularity Complete, it is cost-efficient, definitely. Being pretty much solely on the technical side, I am a bit removed from that.

I would compare SentinelOne Singularity Complete favorably with other solutions or other vendors. It is easy to set up. It is easy to administrate. As with all solutions, you do need to put some effort into the initial deployment. That is going back to the whole beauty of it. It is easy. It takes a workload away from your team. You do not need to worry about so many things after you have it deployed.

My clients have mainly deployed SentinelOne Singularity Complete in the cloud, on-premises, and hybrid models.

I deploy SentinelOne Singularity Complete for myself and for my clients using the cloud for the console, but the agents on all the endpoints.

It is super easy to maintain SentinelOne Singularity Complete. When there is a new agent version, I do ring testing, for example, I do an internal deployment first before I roll it out to my clients. New versions come out every couple months. Beyond that, if there is an arising issue, if a client starts using new software, that also may come up if there are issues in interoperability with SentinelOne. In banking software for example, that is a common thing. Beyond that, it is super easy to maintain.

My advice to those looking into SentinelOne Singularity Complete is to do a proof of concept. Do a small-scale deployment across all your departments. See how it performs and see if there are any issues.

SentinelOne Singularity Complete is an XDR solution for endpoint protection and EDR. I am an integrator and reseller of both their SIEM and XDR platform.

SentinelOne also has an AI SIEM that operates as a different solution on top of the XDR platform, which is very useful especially for organizations that do not have any SIEM but already have the XDR platform. With the XDR platform, I am able to correlate data from other solutions.

Their AI SIEM consolidates everything under one platform. The way it is very easy is that one agent does everything. Whether it is cloud, on-prem, or endpoints, one agent handles that part. If you have the SIEM as well, you can ingest logs from your cloud workloads, from your on-prem devices, whether it is a security device or other devices like your network switches and applications. It is able to ingest data from all platforms.

SentinelOne Singularity Complete is your endpoint platform that covers everything. It covers Linux, Mac, and Windows environments as well as your cloud workloads and Kubernetes workloads. If you are looking to integrate other solutions or devices, you need the AI SIEM, which will take care of third-party solutions, firewalls, identity access, PAM, and other integrations. If you want to bring those feeds onto that platform, you need the AI SIEM part for it. In terms of XDR, it covers the major platforms including Linux, Windows, and Mac.

The Ranger functionality is good, though I believe they have renamed it recently. If you want to do network discovery on your network to know what is running on it, Ranger is very good.

Purple AI is built into SentinelOne Singularity Complete platform. Purple AI helps engineers perform threat hunting without requiring SOC analyst experience. You are able to threat hunt and respond to threats using normal language conversation.

Because you are able to converse with it using natural language, you are able to build out responses using Purple AI that it will enact autonomously.

It is priced by endpoint device, making it one of the well-priced solutions. It is not too expensive and is a very good enterprise solution.

The most valuable feature is rollback on ransomware and malware because it is one of the only solutions that can do real-time rollback on ransomware and malware.

With SentinelOne Singularity Complete, you have virtually 99.9% zero false positives, which means when it is doing its detection, it is very good at it.

Because the detection engine can be fully autonomous and AI-based, the IT team is not bogged down looking for threats or hunting for threats. Most of the threats will be detected and remediated autonomously, which makes it very useful.

Because of the false positives and the detection engine that it uses, it vastly reduces the detection time because it is AI-based.

Because it is autonomous, you have more or less instant response if it detects a threat.

It is doing most of the work currently. The only thing that would help complete the solution is the ability to execute and perform patching from the system since it is able to discover vulnerabilities and CVEs on the system. That is the one improvement that I have had from clients.

Five years plus.

I have not had any issues personally. I do not know everyone's experience, but I have not experienced any yet.

It is extremely scalable, so it is very good. I would rate it a ten out of ten. You can use it for very small organizations all the way to extremely large organizations.

I have not had to contact them for troubleshooting. When we are doing proof of concept, I speak with the SentinelOne team. In terms of them having to come in and troubleshoot something, that has not happened yet.

The material is readily available for anyone, and mostly they have what I need. I do not need to refer anywhere else.

The only new solution that I have added is SentinelOne, not any other.

The setup is very straightforward and not difficult to do. All you need to do is deploy the agent onto the endpoint machines and then configure the detection and response policies. Other than that, it is not much and is very easy.

Setup is normally done by SentinelOne, but deployment is handled by us. The setup is an online setup unless it is on-prem. For on-prem, I am involved, but most users will not get on-prem deployments. Cloud deployment is done by SentinelOne themselves, and then we come in to do the deployment.

My use case working with Singularity Platform was to implement clients from the insurance business onto the platform.

Singularity Platform's best features are its scheduled reports and its automated end-of-day business capabilities, which allow any activities that occur projected or expected to come in overnight without manual intervention.

Concerning Singularity Platform's real-time monitoring capabilities, they are not truly real-time, as they were always a day behind, meaning they look at results from the prior T+1 business day. They are getting as much real-time information as they can, and depending on what the insurance team decides to do in terms of logistically buying and selling on a certain day, they can see their impacts on their current cash balances. This allows executives to determine if they have to liquefy any of their assets at a certain point in time, providing a great view in terms of risk management and current available cash balances while also considering the strategic direction in the next year or two where they plan on going with their cash balances.

I believe there is room for improvement in Singularity Platform regarding its product. First of all, with all automated systems, they need to have the capabilities to expand rather quickly. When I was there, I do not believe they had the ability to do that. In addition, they are very concentrated on certain clients which they have contractual obligations to meet.

As for other areas that could be improved in Singularity Platform, I believe there are a bunch of customer-facing uploads that need improvement. The communication between clients and the teams working internally with that client also needs enhancement. The automation itself has to be increased in terms of bandwidth or capability of the system. For example, there were times when there were severe lag problems on the system due to capacity issues. They may not have had enough servers. There was a lack of response time at times.

My experience with Singularity Platform is over three years.

I would rate the stability of Singularity Platform as a nine. Of course, you will sometimes have outages across certain regions; it just happens. However, during the amount of time I worked on it, I did not have any instances of an outage, although I cannot say everything is perfect.

Regarding scalability, I believe it deserves a seven out of ten, or a seven and a half. I believe that the system is scalable but it all goes back to personnel behind the scenes and the availability of those people, plus the knowledge they hold in terms of being able to bring larger clients onboard. I am not saying they are awful; they just need to ensure that they have the right personnel.

I would rate the technical support of Singularity Platform as a six.

The reason I rate it a six out of ten is because they have a lack of IT resources to be responsive in real-time, and they are very siloed in terms of knowledge. A lot of people have to reach out to one sole person who has basically developed the system, creating a bottleneck for responses and making it hard to know when you will get a reply or where it stands in terms of priority.

Positive

I believe that CAM and Clearwater are superior to Singularity Platform.

Overall, I believe that in any cloud-based platform there are challenges. However, in terms of implementation for Singularity Platform, the average implementation is about 90 days, which is pretty reasonable given the circumstances. I do not believe there is any advantage or disadvantage in moving from Singularity Platform to any other platform.

In terms of pricing for Singularity Platform, I believe they are competitive with the market. I do not believe they are cheap or expensive; I believe they try to be within a few basis points of other offerings. My philosophy is you pay for what you get, so if you decide to cheapen out on the cost of your platform, you are not going to get what you want.

If Singularity Platform is reasonably cheaper than Clearwater, then you could use it as it will still do what you want, though it may not be as comprehensive as Clearwater.

Regarding Singularity Platform's real-time personalization feature, it does help with my customer experience strategies because, in my personal experience, I have taken a role as Treasury Manager and I am dealing with investment accounts every day. To do all that work manually compared to any type of platform work is pretty painful, so I would say anything in an automated space for any investment, any company with a bunch of investments in a portfolio, Singularity Platform is an option.

Singularity Platform does help with fraud detection in the financial services as it has rules involved for risk management. If there was a purchase done, the way Singularity Platform works is it is fed in the custodian feeds as well as the bank feeds. There is no current trading platform associated with it, but there may be things in the works that will include a trading platform. I would say that there is a compliance module within Singularity Platform that helps clients determine if they want to remix their portfolio balances to stay compliant with whatever loan agreements they may have.

Regarding Singularity Platform's customizable dashboards, I believe they help optimize operational efficiency. Since my role was really behind the scenes, not as a developer but on the QA implementation side of things, I believe any platform that can customize for any client will actually help them in the long run. I believe that having reports that are unique to each individual client helps them in their own way, so whatever reduces the manual workload for the client, especially customizing UI, is a good idea.

I would absolutely recommend Singularity Platform to other users, but it depends on what their expectations are for the investment accounting software they plan to implement. For a smaller size insurance company, I believe that is fine. However, there are things that Singularity Platform cannot do that Clearwater does, and I am sure there are things that Clearwater does not do that Singularity Platform does. Therefore, it is hard to say definitively; it really depends on the client's needs. For a full-blown investment accounting and reporting system, I would still recommend Clearwater over SS&C. In terms of asset management and banking solutions, I cannot really respond because I believe SS&C and Clearwater probably have the same application capabilities.

I would rate this solution a seven out of ten overall.

My main use case for SentinelOne Singularity Endpoint is managing threats and other security measures day-to-day.

Basically, the extensions that I am working on are focused on threat level and investigation level with SentinelOne detection response.

Regarding my main use case with SentinelOne Singularity Endpoint, I have many options to take control from SentinelOne Singularity Endpoint such as disconnecting for troubleshooting.

In my experience, the best features SentinelOne Singularity Endpoint offers are designed to protect.

What stands out to me regarding its real-time threat detection, automated response, or ease of use is that we have truly real-time protections, which we can call behavioral threat protection.

The behavioral detection helps my team in day-to-day operations by enabling us to take immediate action.

Another feature I think is worth mentioning is a new feature called VSS snapshot.

SentinelOne Singularity Endpoint has impacted our organization positively, mainly through cost savings compared to other endpoints.

Regarding cost savings, we can compare SentinelOne with other EDR solutions, and I find that SentinelOne is less costly while also having a higher security level for endpoints.

For improvement, I could say that there is a report level which needs to be improved at the endpoint level.

Regarding SentinelOne Singularity Endpoint's AI capabilities, I think it would be very good if we have more AI capability for endpoint level governance, which we currently possess.

The accuracy and reliability of SentinelOne Singularity Endpoint's AI output provide quick information about threats and their management, making it reliable very often for us.

I have been working for almost nine years in cybersecurity.

SentinelOne Singularity Endpoint has been stable in my experience.

Its scalability is very good; it has been easy to manage.

Customer support for SentinelOne Singularity Endpoint is very good, but I think there needs to be more improvement in the support level to ensure proper responses for customers, especially during session requests.

Previously, we used McAfee, and we wanted to switch to SentinelOne to see how it would protect our endpoint.

Based on my experience so far, I believe it is fine now, as I already mentioned regarding improvements needed.

I purchased SentinelOne Singularity Endpoint through the AWS Marketplace.

I have seen a return on investment in terms of money saved as well as time saved.

It has saved a lot of time for us, allowing us to reduce the time previously spent by our team, which was two to three hours.

SentinelOne Singularity Endpoint has completely reduced our Mean Time to Detect (MTTD), which has changed from the usual eight hours down to two to three hours.

It has improved our Mean Time to Respond (MTTR) significantly; while we used to take two to three hours, SentinelOne Singularity Endpoint can manage it within minutes, hardly ten to fifteen minutes.

My experience with pricing, setup cost, and licensing has been good, and I feel it is very much fine compared to other EDR solutions.

Before choosing SentinelOne Singularity Endpoint, I evaluated other options, including CrowdStrike.

The advice I would give to others looking into using SentinelOne Singularity Endpoint is that it saves money and enhances the protection level; it is also very good for saving time on analysis tasks.

Singularity Complete has helped us consolidate our security solutions and it has been completely secured at the endpoint level, which is very good for us.

We use SentinelOne Singularity Endpoint's Ranger functionality for asset visibility, which is important for our endpoint protection level and to assess the health and status of security.

Singularity Complete has reduced alerts significantly; we used to get many alerts but now we are getting very few, and those are true positives only while previously we experienced many false positives.

I would rate this solution nine out of ten.

We use SentinelOne Singularity because we didn't have a strong cybersecurity platform, and I wanted to make sure that my company wasn't going to be vulnerable to cyber-attacks. I also wanted to make sure that it was user-friendly, so it didn't have to have an end user that was managing everything. I saw that AI actually manages everything for you, so it's super user-friendly.

SentinelOne Singularity's interoperability with other solutions or third-party applications seems to flow nicely.

SentinelOne Singularity handles ingesting and correlating across the security solutions without me having any problems.

The most valuable feature of SentinelOne Singularity is that it's automated. The AI is constantly working in the background, tracking and blocking cybercriminals or bad actors.

SentinelOne Singularity saves me time every day that I use it, as it is easy to manage and easy to install.

SentinelOne Singularity has improved my organization overall by allowing us to get cybersecurity insurance, which I think is very hard to get. We have coupled SentinelOne Singularity with some other cyber platform, and now we are insured as well.

SentinelOne Singularity is super easy for scalability; we are constantly adding more computers and users, and it's compatible with everything else that we're using.

When sending out new updates, you have to figure out which one is the right one, so it would be easier if they committed to that, because when you're sitting out updates, there are different names and something different, making it tricky to figure out which one is compatible with your program or company.

I have been using SentinelOne Singularity for probably three years now.

I haven't had any issues with SentinelOne Singularity regarding stability, such as lagging, crashing, or downtime.

Their technical support is very responsive, helpful, and knowledgeable.

On a scale of one to ten, I would give their support a ten.

I have a very positive impression of SentinelOne Singularity as a strategic security partner, and I'm very happy with the product. I plan on keeping it because we had another product that wasn't easy or user-friendly, and we ended up not renewing that, while we plan on renewing SentinelOne Singularity every year.

In my opinion, it was super easy and straightforward.

We did the deployment all by ourselves in-house.

I was involved in the deployment.

The return on investment I've seen from SentinelOne Singularity is huge because we now have cyber insurance, and our workload is less. We don't have to pay the price we were paying for a whole IT company for computers and malware solutions since we are saving money ultimately.

I have never tried using Ranger.

My mean time to detect is eighty percent.

The meantime to respond is the same story.

My organizational risk has been reduced.

I am having a really good experience with SentinelOne Singularity, so I can't say there's anything they can improve because I'm not having any problems. Even if I have an issue, they're super responsive.

I think SentinelOne Singularity's pricing or licensing is very comparable and competitive.

SentinelOne Singularity requires maintenance on my end, such as making sure to send out any new agent updates quickly.

On a scale of one to ten, I would give SentinelOne Singularity an overall score of ten.

I would advise others evaluating SentinelOne Singularity that if they're looking for something simple, user-friendly, and that stays up to date with what's happening, this is the product for you.

SentinelOne Singularity Complete has allowed me to perform multiple functions. It enables asset ingestion, and I have been able to identify other machines that don't have the endpoint agent installed. We've caught some malware. SentinelOne has internal reporting features and Ranger features that search the subnets where SentinelOne agents are located for other devices that may not be protected with the agent. The platform itself allows me to visualize my entire environment.

SentinelOne Singularity Complete has allowed me to perform multiple functions. It enables asset ingestion, and I have been able to identify other machines that don't have the endpoint agent installed. We've caught some malware. SentinelOne has internal reporting features and Ranger features that search the subnets where SentinelOne agents are located for other devices that may not be protected with the agent. The platform itself allows me to visualize my entire environment.

The ransomware rollback feature is the best aspect of SentinelOne Singularity Complete that stands out the most. We haven't had to use it yet, but it allowed me to demonstrate to our insurance providers that I had a recovery mechanism for the rollback.

SentinelOne Singularity Complete has positively impacted my organization by helping with trust amongst the organization. There is no longer any doubt that we are protecting the endpoints. Also, with USB exclusions and other features, it has helped with data loss prevention. I am now able to measure DLP attacks.

My impression of SentinelOne Singularity Complete's ability to ingest and correlate across my security solutions is phenomenal. It's great to have that central location. With SentinelOne Singularity Complete, I have been able to remove three additional products from the environment.

I use SentinelOne Singularity Complete's Ranger functionality, and it's one of the most important things I have.

There really aren't any areas for improvement in SentinelOne Singularity Complete. I'm excited to watch the continuous improvement to the storyline.

SentinelOne Singularity Complete is stable in my experience.

SentinelOne Singularity Complete's scalability is extremely easy to achieve as new endpoints and new detection points come on board.

The customer support for SentinelOne Singularity Complete is phenomenal.

I would rate the customer support a ten on a scale of one to ten.

Positive

We were a new company, and we picked SentinelOne Singularity Complete first without using a different solution before.

SentinelOne Singularity Complete has helped free up my staff for other projects and tasks by saving us multiple hours a day because we can now get the visibility and the automation.

SentinelOne Singularity Complete has helped reduce my organization's mean time to detect by fifty percent.

SentinelOne Singularity Complete has helped reduce my organization's mean time to respond by eighty percent.

My experience with pricing, setup cost, and licensing for SentinelOne Singularity Complete was flawless while working with my account manager. For the first time in a long time, I enjoyed the process.

I did not evaluate other options before choosing SentinelOne Singularity Complete.

The advice I would give to others looking into using SentinelOne Singularity Complete is to have your inventory counts available, document your ingestion points, and proceed with the implementation. I think it's a great product. I would rate this review a ten on a scale of one to ten.

I use SentinelOne Singularity Endpoint for endpoint protection. I utilize it for different companies and different purposes. It is effective for endpoint detections and remediation of the detections. Additionally, I use it for new endpoint discovery within the company intranet. Overall, I use SentinelOne for incident response activities.

The best features in SentinelOne Singularity Endpoint are the Sentinels and the features provided within the Sentinel module, which include machine identification and machine details. I can accomplish everything within the endpoint using these features. Endpoint Sentinel is a good detection rule, and if I can create or already have created rules, these are good working rules that protect my organization and make the endpoints more secure.

Ranger is also a cool feature that provides visibility of new endpoints that have been attached or connected within my infrastructure that do not have SentinelOne Singularity Endpoint agent installed on them.

Before using SentinelOne Singularity Endpoint, I used different products, including CrowdStrike. In the space where SentinelOne Singularity Endpoint is working, it is an awesome product. However, I believe the vulnerability management is currently in pilot. If it can mature into good production where the vulnerability management module is working well within Singularity Complete edition, that would be an awesome step. The vulnerability assessment is available, but application vulnerability assessment or other endpoint vulnerability assessment is not as good as what other products are providing.

Singularity Complete is a good product in its area and, obviously, when comparing to other organizations or companies providing endpoint detection solutions, it is an end-to-end solution for antimalware and XDR. This has been working fine for me so far. I am using it in small, medium, and enterprise organizations, and it is good. However, as I mentioned for the vulnerability assessment, along with the specification of handling core, detailed forensics, there could be more details I would add. However, if I recall correctly, there is a specific module within SentinelOne Singularity Endpoint to check all details of the functions that happened within the target machine. I am currently unable to recall the name of that module, but it exists. However, there is room for improvement where more details of the solution or from the target can be added, and this would help me more easily identify the impact or the root cause that impacts the endpoint. This would be more helpful for end users. Currently, if there is an impacted endpoint, I click on the endpoint, and it gives me insights about what happened with this endpoint. However, when I need to go into the details, there is some limitation to viewing those details for the target machine. It would be awesome if this module could be integrated into the normal Sentinels. This would be more helpful for engineers working on core identification of root causes.

I have been working with SentinelOne Singularity Endpoint for more than two or three years.

It is working fine for me. In the majority of cases where files have been detected as malware or virus within the organization on the target machine, they are quarantined. This is good functionality from XDR, as I mentioned earlier.

For me, it is good, but I believe SentinelOne Singularity Endpoint does not directly engage with customers who have fewer than one thousand nodes. I have to engage through SentinelOne's partners. This is an impact based on market or company strategy. The pricing is not too bad; it is good. If I directly engage the organization or company, the pricing is different and obviously better. Additionally, when I go directly within the company, they provide visibility or vigilance services to customers at the same price. When I go into the partner channel, my account is within the partner's umbrella, and they provide limited support for visibility and further incident investigations. This is a limitation for small and medium organizations. However, for large organizations that can directly engage SentinelOne Singularity Endpoint, this is a positive point, but there is a lag when I go into the partner channel. The partners engage with customers in their own way, and that is how it works.

For me as an end user, the setup process was not difficult because everything was set up from the partner's side. I may not be the right person to answer for all aspects. For the end user, it is very easy. The partner set up the whole environment within a week or two. After creating the whole setup, as an end user, I would just have to install SentinelOne Singularity Endpoint agent into my end user devices or servers. It is easy to do that. Once I do this and the environment has been set up with all Sentinels collecting data from end user devices or servers, everything is there and the environment has been set up. It is easy for end users, but obviously for those creating the environment, the whole environment, creation of security rules, detection rules, and those kinds of things may be challenging, especially for beginners. That would be the challenging part, and I did not do it earlier, so I cannot comment on it fully.

It is comparative to other products and is cost-efficient.

This is a competitive market with competitive solutions that have core good products and features within them. If I am looking for an endpoint protection solution, this is a good product because I always compare SentinelOne Singularity Endpoint with CrowdStrike and Microsoft Defender. Based on that comparison, if SentinelOne Singularity Endpoint had good vulnerability assessment capabilities, because currently the vulnerability assessment is based on the application, not the operating system, it would be a good point from the perspective of cost-efficiency along with the features within the product. SentinelOne Singularity Endpoint has Ranger, Sentinels, and visibility where I can go in and have detailed knowledge about every detection along with every happening on the target machine. This is good, but SentinelOne Singularity Endpoint is still lagging under the vulnerability assessment module.

SentinelOne Singularity Endpoint provides alerting into the dashboard, but I did not configure it correctly and never received alerts over emails. If such a feature exists within the product, that would be awesome, and I could incorporate and configure it. Currently, I do not have visibility on it. Once I log into SentinelOne Singularity Endpoint, it provides visibility within the dashboard showing how many endpoints have been detected as infected, how many endpoints are impacted, and how many endpoints have been identified as malware where SentinelOne Singularity Endpoint has quarantined those files, and I can do analysis and further processing. However, currently, I did not configure it if it is available, but I am unable to navigate it. I do not have visibility on whether any endpoints or target machines have been impacted so that I receive email notifications or SMS notifications alerting me that a machine has been impacted and needs to be worked on urgently. This is a critical function I need to perform right now. If this would be configurable or is available in SentinelOne Singularity Endpoint, that is awesome. If not, then the alerting mechanism needs to be improved to get alerts over emails or SMS for at minimum critical assets.

I can say that I currently did not implement it in such a way because for what I am using SentinelOne Singularity Endpoint for, it is the on-premises infrastructure for some organizations and just for endpoints in other organizations. In that case, I believe for SaaS products, I am currently not utilizing it for such things. My question is whether SentinelOne Singularity Endpoint is an agent-based solution that I can only utilize on endpoints or servers or where the operating system is Linux or different flavors where the operating system is running. However, for the serverless environment, SentinelOne Singularity Endpoint cannot work. Is that the right expectation?

Obviously, the core concern is about data protection and privacy. There is something I have to adopt with AI. If I do not adopt it, I am not running with the market and chasing new goals. The thing is I have to implement frameworks such as ISO 42001 to manage data and contain my data's confidentiality and privacy. This is core importance for me in my job role. I take care of this all the time, and obviously if I am integrating solutions that utilize AI-based features into their product, I do have vendor management or vendor risk management to perform with vendors. I currently look into AI standards or framework implementation within organizations if they are providing me with full core data security. This is the point I engage in with existing and onboarding vendors. Additionally, I am currently utilizing AI and making AI models within my organizations. I implement security standards and maintain the whole implementation and operationalization of data protections within AI models and machine learning models.

This is the function that can be adopted, and if it is in the product, obviously this is a positive point and I do encourage that utilization of AI models within products. As I mentioned, if I got email alerts or SMS alerts for critical systems and if AI has been engaged into threat modeling with well-known algorithms that identify what threats, viruses, or malicious insights have been identified in the system, and if AI can guess that certain operating systems, files, or things are critical to my organization and can do this on a real-time basis, that would be a positive point. Obviously, as I mentioned, if I want to run with the market, I have to integrate those AI threat modeling or AI remediations within my organization. I have to do that. I give this review an overall rating of eight out of ten.

My use case for SentinelOne Singularity Endpoint is that it is basically an EDR XDR platform that detects, investigates, and responds to cyber threats on endpoints, while also providing real-time visibility, automated threat detection, ransomware protection, and incident responses, thereby helping security teams protect the system from advanced attacks.

What I appreciate most about SentinelOne Singularity Endpoint is its automation features such as automated threat detection and responses, which can detect malicious activity, isolate devices, and even automatically roll back ransomware damage. It reduces response times and workload, making it the best feature in my view.

We correlate SentinelOne Singularity Endpoint with multiple device types, making it easy to respond to any triggered alerts, enabling us to link related security events and create a complete view of an attacker. This helps us analyze and understand how a threat spreads and impacts our systems, thus improving investigation speed and reducing false positive alerts for faster incident responses.

I believe SentinelOne Singularity Endpoint is a strong security platform, but areas for improvement include reporting and dashboard customization, as well as providing more advanced threat hunting queries and easier navigation for new users, which would enhance the overall experience.

I have been using SentinelOne Singularity Endpoint for more than two to three years.

SentinelOne Singularity Endpoint is a stable and reliable platform that delivers continuous endpoint protection with minimal performance impact, efficiently handling large environments and providing consistent security monitoring and response capabilities without any observed lagging or downtime.

The scalability of SentinelOne Singularity Endpoint is excellent as it is highly suitable for both small and large organizations, capable of protecting thousands of endpoints while maintaining good performance, making it a smart choice for growing businesses.

I have contacted technical support several times and found them to be excellent as they respond quickly to my queries, providing dedicated support with knowledge-based documentation and training resources that assist engineers in troubleshooting, deploying policies, configurations, and threat investigations, helping our organization maintain smooth operations and resolve security issues quickly.

The quality and speed of support are excellent. Whenever I raise critical alerts or incidents that could impact business, the response is usually within ten to fifteen minutes, allowing them to troubleshoot and suggest actionable steps very quickly.

I have used CrowdStrike for two to three months, along with other tools including QRadar and Splunk.

When comparing CrowdStrike to SentinelOne Singularity Endpoint, I prefer SentinelOne Singularity Endpoint more because it is more autonomous and AI-driven in its responses. It can automatically detect, kill, quarantine, remediate threats and roll back, including features such as asset discovery and ransomware recoveries, as well as providing strong offline protections. On the other hand, CrowdStrike offers excellent threat intelligence and managed threat hunting, utilizing a cloud-native architecture with lightweight agents and offering visibility and threat detection through the Falcon platform, which is widely adopted by large enterprises.

The initial deployment of SentinelOne Singularity Endpoint was straightforward as I integrated it with multiple types of tools including threat intelligence platforms, cloud servers, firewalls, and ticketing tools, improving visibility and automating workflows to enhance overall security operations.

I reviewed SentinelOne Singularity Endpoint, which is called Endpoint Detection and Response.

Regarding the pricing for SentinelOne Singularity Endpoint, I think although it requires investment, it helps reduce security risks and ransomware attacks while lowering operational costs through automation, providing excellent value and return on investment due to its strong protection and rapid response capabilities.

SentinelOne Singularity Endpoint requires minimal maintenance because it offers cloud-based management and automated updates, allowing security teams to manage policies, monitor threats, and maintain endpoint security from a centralized console.

I have used the Ranger feature, which provides network visibility and asset discovery by automatically identifying unmanaged devices connected to the network, including laptops, servers, and printers, helping security teams find unknown assets and reduce blind spots to improve overall security visibility without requiring additional hardware.

I have used Purple AI, which is designed for incident analytics, enabling me to ask questions such as showing all devices affected by specific threats. It quickly provides insights into incidents and recommends actions for investigations.

Purple AI is designed with data privacy and security in mind, ensuring that customer data is processed according to compliance requirements, which allows organizations to maintain control over their data while using AI-powered assistance for threat investigations and analysis. My overall rating for this product is eight out of ten.

I create policies based on the regarding policy, which means I created custom rules regarding the use case and customer use case.

Most of my use cases are related to the event ID and the process event, so it is easy to use.

My impressions of SentinelOne Singularity Complete's ability to ingest data and correlate across the security solutions is that it is better for blocking the hash value and generating the rules manually. It is easy to use.

Overall, SentinelOne Singularity Complete helps me consolidate my security solutions, being the best in endpoint, cloud, and identity.

The best features in SentinelOne Singularity Complete are in the SIEM solution, including the block list in hash value block list and anti-tampering mode.

The best part of the Ranger functionality is that it helps find known and unknown devices, locate IoT devices, and determine how many agents have not been installed in SentinelOne, making it easy to count how many machines are not installed and find IoT devices.

SentinelOne Singularity Complete has helped reduce alerts for me, with the best part being the exclusion, as it has already marked most of the alerts in the cloud as false positives.

SentinelOne Singularity Complete has helped free up my staff for other projects and tasks.

In the SIEM solution, I would like to see improvements in the data injection process, as it is very fast, and the log collector option is very nice. However, there are issues in blocking the hash, which is complicated due to different segregation for Windows, Linux, and macOS, so I ask for an improvement in this hash blocking function and the manual generation of how many VSS snapshots.

I have been working with SentinelOne Singularity Complete for the last two years.

The performance issue with SentinelOne Singularity Complete is very good, but the hash blocking remains complicated and generating many snapshots manually is a recurring challenge.

I work with the Ranger functionality in SentinelOne Singularity Complete, which is used to identify known and unknown devices both in and out of networks.

I evaluate the customer support team of SentinelOne Singularity Complete highly, stating that they provide good support with 24/7 availability.

Positive

I decided to switch to SentinelOne Singularity Complete because it offers a single solution for the endpoint SIEM and singularity purpose, and the console is very easy to handle.

There were challenges during the setup, particularly with the custom rule as the customer asked for application-level blocking that I did not fully understand.

The project time is not the means full completely solution but it saves up to 40 days.

Apart from the escalation matrix, I have seen improvement in the mean time to respond, with critical alerts raised below up to 15 minutes and false positive alerts raised in up to one hour.

I mostly use the custom rule and small things for the event type, event query, and searching in event query, focusing on endpoint based solutions in SentinelOne Singularity Complete and the SIEM solution.

I would rate the technical support of SentinelOne Singularity Complete a nine.

I have no recommendations for improvement regarding SentinelOne Singularity Complete as a product or solution.

I rate this review a nine overall.