SentinelOne Singularity Platform

My main use case for SentinelOne Singularity Endpoint is that I have a few clients who use it as an enterprise EDR solution because it is powerful, not heavy for the system, and it has really good ransomware protection. Additionally, it does not require many resources compared to other competitors.

I can share a specific example of how one of my clients uses SentinelOne Singularity Endpoint for protection. Since it is installed on all their company workstations, they benefit from an excellent experience offering both antivirus and anti-ransomware protection. Specifically, it blocks all the minor everyday threats, and in one instance, it successfully blocked a ransomware attack before propagation to another computer.

Regarding how my clients use SentinelOne Singularity Endpoint, they are really happy about it because before they were using Sophos Endpoint and had the same protection, but it was much heavier on the machine and used significantly more resources—around 200 MB of RAM more than SentinelOne. This additional resource consumption is excessive, specifically in large networks where not all computers are powerful or recent.

SentinelOne Singularity Endpoint's best features stand out to me because I really appreciate one feature named Storyline, and it works exceptionally well with automatic rollback. These features track activity continuously and map each single process in real-time, allowing me to have a visual reconstruction of what is happening. I can fix issues with one click and perform a really good and fast rollback of a computer in response to malware or ransomware. These features have worked really well in the past with encrypted files that were infected just a few seconds following the initial infection.

Storyline has really helped me and my clients in real investigations and incidents. Using the dashboard and Storyline, we can visualize a map of the infection and see how it was extending, which allowed us to find where the infection started. In that case, it was an old PC without SentinelOne Singularity Endpoint protection, but we saw in the logs an infected computer that spread infection over the network from a non-protected computer.

I would add that the AI agent can work directly on the endpoint without relying on the cloud, and the autonomous mitigation feature is really powerful. Additionally, the EDR cloud dashboard allows us to have a very clear visualization of the status of the entire company.

SentinelOne Singularity Endpoint has positively impacted my organization and my clients in several ways: it improves security, speeds up device performance because the previous EDR protection required more resources, saved time during boot time of computers, and reduced incidents. Thanks to the dashboard, it provides a comprehensive status of the company, allowing them to invest money wisely over time.

I would really appreciate having raw data of what is happening presented in a clearer format. Additionally, a cloud backup of malware would be beneficial so that we can maintain a copy of the ransomware and malware on SentinelOne for analysis purposes.

I would not want to add more about needed improvements because all of the current capabilities are really awesome, and they have done a really good job.

I have been working as a security analyst for the last four years.

I rate SentinelOne Singularity Endpoint a nine out of ten.

I give it a nine out of ten because, having worked with all the competitors, there are others that have some more advanced features, but SentinelOne Singularity Endpoint is really wonderful. I know they make a really good product and it is one of my favorites, but it is not perfect.

Regarding SentinelOne Singularity Endpoint's AI capabilities, I appreciate that feature, but I set rules manually all the time. I have never used or tried to use AI for that purpose. I prefer to use AI to ask about status and to monitor activity, but not for everything else. I have not tried using it for other purposes.

In monitoring, I have used SentinelOne Singularity Endpoint and it is really wonderful; the accuracy is really high, and I trust the output completely. For me, it is really good for all the other capabilities of SentinelOne Singularity Endpoint, which I have never used outside of monitoring. I do not have knowledge about those aspects.

SentinelOne Singularity Endpoint is deployed for my clients in different ways. I have a customer using the public cloud, where SentinelOne Singularity Endpoint protects a few virtual machines and containers in a Kubernetes cluster. I have other customers where it is on-premises and the agent is installed directly on physical endpoints, mostly Windows, to monitor local operating system behavior.

For the public cloud deployment, my customer uses AWS.

I did not purchase SentinelOne Singularity Endpoint through the AWS Marketplace; it was purchased with an Italian SentinelOne reseller.

I appreciate the data ingestion correlation of SentinelOne Singularity Endpoint and the automated Storyline; all of that is really wonderful. SentinelOne Singularity Endpoint helps me connect and analyze data from multiple sources. We have made some integrations with next-generation firewalls such as Palo Alto, and there are integrations that allow us to merge the data into SentinelOne Singularity Endpoint's Data Lake, which reduces our time for data analysis because we can find everything together in SentinelOne Singularity Endpoint.

SentinelOne Singularity Endpoint Complete has helped me consolidate my overall security solutions, also thanks to the automatic Storyline correlation. When Palo Alto logs go into SentinelOne Singularity Endpoint, the AI of SentinelOne Singularity Endpoint connects them to the Storyline technology. For example, one user from a company downloaded a suspicious file, which triggered the advanced threat protection of the Palo Alto firewall. All the data from Palo Alto is integrated with SentinelOne Singularity Endpoint; the AI merges the data from the computer and the firewall, allowing us to conduct a full analysis within SentinelOne Singularity Endpoint and providing a clear visual representation of how the attack or event unfolded—a diagram of the sequence of what happened during a security event.

Using SentinelOne Singularity Endpoint has reduced alerts for me and my clients because the agent acts as a teacher for the user, making the good and bad status of a workstation visible to the user, which encourages them to be more careful about their actions. It is really easy for them to use; the first problem in any company is human error.

SentinelOne Singularity Endpoint Complete has significantly freed up IT and SOC personnel by reducing their daily security operation workload, potentially by around thirty percent.

SentinelOne Singularity Endpoint has helped reduce my organization's Mean Time to Detect. Personally, I have saved between fifteen to twenty hours every week of work, allowing me to reallocate my time to infrastructure projects and other cloud migration tasks. This has given me a lot of spare time where it is most needed. The time savings come from the very core capabilities of SentinelOne Singularity Endpoint: Zero-Touch Remediation and Rollback, automated root cause analysis via Storyline, and the mitigation of alert fatigue.

The automatic capabilities of SentinelOne Singularity Endpoint have reduced the time to respond to incidents by an incredible ninety percent, and this is thanks to the automated emails sent to the security department whenever a potential incident occurs.

The autonomous response capabilities of SentinelOne Singularity Endpoint, specifically Zero-Touch MTTR, allow the agent to evaluate the threat locally on the endpoint and execute immediate containment protocols without waiting for human intervention, achieving an MTTR of under one minute, which is significantly different from competitors.

I do not have experience regarding pricing, setup costs, and licensing for SentinelOne Singularity Endpoint because I work in the IT and security department and do not have access to customer pricing information.

I do not have information about money saved, but I can tell about time saved. In my team, I currently have fifteen free hours each week, and the other four members have reduced their work by more than twenty hours a week.

My advice for others looking into using SentinelOne Singularity Endpoint is to definitely test the rollback feature in a sandbox because it is incredibly powerful, and it is truly awesome to see how quickly it works.

I really appreciate this product, and I want to pursue some certification courses for SentinelOne this autumn. Overall, I rate this product a nine out of ten.

I use SentinelOne Singularity Endpoint generally as an IDR, so I'm using it for searching about threats or for doing containment and eradication, also the part of triage, but the eradication and containment are more important.

Generally, I use SentinelOne Singularity Endpoint for containment and eradication. One example was when we had a ransomware or a malicious activity on an endpoint, you can automatically isolate the affected device from the network. This prevents the threat from communicating with other systems or spreading laterally. This can be useful as well while still allowing the security team to manage the endpoint throughout the SentinelOne Singularity Endpoint console. For the console, an example for the containment and remediation is when we kill the malicious process or remove a malicious file, put it in quarantine or do some remediation or some rollback change can also use it for restoring the endpoint affected before the threat. We restore all the files and all the system changes if there is some modification of key or configuration. This is very important for this phase of the attack containment and eradication.

I always use SentinelOne Singularity Endpoint for checking the chronological attacks or how the start point and all the chronological activity that the threat actor is doing. All the processes and everything about this is very useful.

There are many features I can mention. I think the best feature can be the behavioral AI because the automated threat detection and response is important ADR we use every day. Also, the storyline, the network isolation, and the one click remediation and rollback. I think the most valuable one is the storyline combined with automated remediation because storylines automatically correlate related events and show the complete attack context, which makes the investigation faster. For example, SentinelOne Singularity Endpoint can isolate the endpoint, kill a malicious process, remediate the threats and support a rollback change. This significantly reduces the time required for an investigation and the response.

The storyline is very important because we can understand how the attack starts and how this finishes. I think this is the most important feature, and in SentinelOne Singularity Endpoint, it is very human. The storyline is important because it automatically connects related security events in a single attack story. Instead of analyzing individual alert process file activities separately, the security team or I as a SOC analyst can quickly understand the root cause, the attack path, and the impact of the threat. From my point of view, this is very important to reduce investigation time and make incident response easier.

The storyline is very important to understand how the attack started, what actions were performed by the threat actor, and how far the threat spread. This is also useful for the context of threat hunting and forensic analysis. Overall, this improves the visibility and helps to reduce the workaround for SOC analysts, especially when dealing with a lot of complex incidents or a particularly complex incident.

I think the impact is significant in our company, especially in the security operation and in the incident response because it improves our visibility across the endpoints and allows us to detect and contain threats much faster. One of the biggest improvements is the automation. Instead of relying heavily on manual investigation and remediation, SentinelOne Singularity Endpoint can automatically detect malicious behavior and isolate the compromised endpoint and perform the remediation including the rollback of malicious changes. This helps us to reduce the mean time to response and limit the potential impact of an attack. SentinelOne Singularity Endpoint is very good because it reduces operational workload, improves the response time and makes the company's endpoint security posture stronger.

I think the area that can be improved is the reporting and the dashboard customization. Also, the other tooling and the false positive reduction is important because it is better to prioritize the critical ones and reduce the false positives. Additionally, the integration from CMDB source solution is another improvement. Because the platform gives a lot of information, creating a customized report for management and different security teams could be easier and more flexible.

I think documentation can improve with more practical troubleshooting. Also, the agent performance is an area for improvement. I think the endpoint agent could be optimized to reduce CPU and memory consumption, especially on older systems. Additionally, policy management could be improved because managing policy across a large number of endpoints and different groups could be more intuitive.

I have been using SentinelOne Singularity Endpoint since 2023, so it has been more than three years.

I think it is stable. I can say it is now nine out of ten in terms of stability.

Regarding scalability, I can say it is highly scalable. We can easily increase the number of protected endpoints without making changes to the underlying infrastructure because of the management platform. We can easily manage the endpoints that have different locations, different departments, and environments in one single console. This is the reason I said now nine out of ten for scalability.

The customer support is good, especially with easy tasks. The response was very faster in the easy tasks and more lower in the more complex issues. But overall, I am satisfied with the quality of support. I can say eight out of ten.

I think we have covered everything because I have mentioned many things that can improve, and I hope they will because thanks to these improvements, they will become a ten out of ten. For now, I think this is the best ADR in my opinion, so I am happy to use SentinelOne Singularity Endpoint every day in my job. I would rate this solution nine out of ten.

I can give many examples in these cases. Generally, we use a lot of Microsoft Defender for Endpoint and Azure Sentinel. I think the ability of SentinelOne Singularity Endpoint to share data with other security tools is very positive. It provides APIs and integration that allow us to send endpoint detection, alerts, and security telemetry to other platforms such as Azure Sentinel, Splunk, or SOAR. This is important because we do not want endpoint security to operate in isolation. Thanks to the integration with SentinelOne Singularity Endpoint with CMDB or with other security stacks, we can correlate endpoint data with information from the cloud, identity, network, and other security sources. This helps with automation. For example, SentinelOne Singularity Endpoint detection can be forwarded to a CMDB or SOAR platform, where it can trigger additional investigation or response workflows. I would say that the integration capabilities are strong and valuable for creating a more generalized and coordinated security operation.

I can say that the platform can help us for other projects because the platform automates many activities such as threat detection, alert correlation, point containment, or detection. Instead of manually investigating every single endpoint, the storyline provides the context and attack chain and allows analysts to make decisions much faster. As a result, we can dedicate more time to threat hunting team, also to security architecture and to cloud security. It has improved a lot.

Of course, SentinelOne Singularity Endpoint helps us to reduce the mean time to detect because thanks to the behavioral AI that is continuously monitoring endpoints and all the activity on the endpoint and identifies the suspicious behavior in real-time, including threats that may not be detected through traditional signature-based methods. This feature is very important. Also, the storyline automatically correlates the activity so our analyst does not need to manually connect multiple events to understand an incident. We can detect and understand potential threats much earlier thanks to these two features. This helps improve our response time and helps to reduce MTTR.

Regarding metrics, I can say forty to fifty percent reduction. I can estimate forty percent because some incidents before could take hours to investigate and do the remediation because you have to do several steps manually. With the storyline and automated containment, the one-click remediation and the rollback, we can handle many incidents much faster, sometimes in some minutes. I can say the time went from hours to minutes. So I would say forty percent is a good estimation.

Pricing is generally positive. It is being considered a premium solution, but the pricing is typically based on the number of endpoints bought and the package on the additional capabilities selected. I think I would say the pricing is competitive considering the security capability and the automation. I would say the pricing is fair for what SentinelOne Singularity Endpoint is giving to us.

Regarding specific examples and time, I can say the main benefits come from MTTD and MTTR. Thanks to the automated remediation, we now do not have to do manual investigation. These are the parts that are the most important.

Regarding SentinelOne Singularity Endpoint, I can first of all suggest to invest in it because I do a lot every day. I would recommend investing time in storyline and automated remediation capability because these are some of the areas where SentinelOne Singularity Endpoint provides the most value. Additionally, it is important to connect SentinelOne Singularity Endpoint with CMDB support or cloud identity which can help to get more value from the platform and improve the incident response process. I do not just deploy the agent and the found configuration. It is necessary to configure the platform based on our environment. This is what I suggest to configure the platform based on our environment and security equipment. With the proper configuration and integration, SentinelOne Singularity Endpoint can significantly improve the detection, response time and overall frequency efficiency.

SentinelOne Singularity Endpoint agent is installed on every user's PC and server in our environment and it is protecting our machines and also collecting all the logs from them.

For example, it detects external attacks when a user opens a malicious website and blocks it. Additionally, when our managers would like to check particular employees and what they are downloading or modifying, we have this data in SentinelOne AICM.

Whenever an employee attaches an external drive, SentinelOne often blocks if any of the files are malicious, so it helps to keep our computers safe.

I appreciate most that it has many AI and machine learning features that decide which situations are dangerous for the PC and which are potentially malicious. In the past when we used a different product, we had this data, but the decision had to be made manually, which provided a huge workload for us as administrators. Right now, decisions are made by agents from SentinelOne and we only have to deal with some exclusions when a legitimate process is blocked, but these situations are really rare.

It is straightforward when we have an alert in SentinelOne; we can create an exclusion directly from this alert and do it within seconds or a minute. If we need to define something broader, then it is also easy to build an exclusion from scratch.

Purple AI, the agent that is able to search through all the telemetry and all the security data from endpoints, is a really helpful feature. With a few sentences of natural language, I can find the data or information about processes I need. This really speeds up the work and helps.

The process of securing our endpoints is much more automated. There is no need or there are only a few cases when we need to do something manually. In most cases, it just runs on the endpoint and protects it without any intervention required. The workload for administrators has been reduced.

In the past, I needed to spend an hour or even two per day. Now I am only checking the logs and alerts, and it takes me 15 to 20 minutes a day.

The number of alerts has been reduced by 70 to 80 percent. Now we have many alerts that were displayed as separate ones in the past, consolidated in one threat by SentinelOne AI mechanism.

The time needed to detect threats has been reduced from minutes to seconds because the agent is working directly on the endpoint and making a decision to block the threat directly on the endpoint without any manual intervention.

The response time is also immediate because the response is automated by SentinelOne agent.

SentinelOne could prepare more native integrations for downloading data from external sources. There are already many integrations available, but it would be beneficial if Purple AI could search also through the data ingested to Data Lake and generate alerts based on external data which is uploaded to AICM.

Regarding functionalities, it is among the best protection that I have checked. However, the price and the fact that each functionality such as vulnerability management or cloud funnel requires additional licenses raises the yearly cost for the company.

I have been using this product for 15 months.

I did not notice any serious issues for the last 15 months.

It is really good. We do not have on-premises infrastructure for management. We use the cloud console and we did not encounter any issues.

I think support is really great from SentinelOne.

They respond quickly and are equally effective at solving the issues.

We replaced our previous security solution one-to-one, but we are evolving and using more and more SentinelOne functionalities, making our infrastructure increasingly secure. We also use vulnerability management and identity security. We do not consolidate but we improve and use new features that we did not use in the past with other products.

We used ESET antivirus with their XDR solution and SentinelOne offered us a better price and we found the solution better in action. The detection ratio is better and AI modules helped us to reduce the amount of manual work needed to operate with XDR.

We use part of the out-of-the-box integrations, so Microsoft Azure and Office 365, and they were included in our license. We did not need to purchase any additional module. It was straightforward to implement. There is good documentation available from SentinelOne, so it was really simple and it works really well.

We are cooperating with one SentinelOne partner and we work with them only for purchasing SentinelOne, with no other relationships.

We were considering also keeping ESET and switching to CrowdStrike, but we finally decided to go with SentinelOne.

I would rate this solution almost a 10, maybe a 9 because of the price. It is not a cheap solution, but it works really well.

It is a really good solution that efficiently protects your endpoints and servers. Even if the price is not as competitive as some other solutions, the functionalities are worth it.

I give this product an overall rating of 9 out of 10.

Our main use case for SentinelOne Singularity Endpoint is to protect all devices in the company. We are protecting all our devices by deploying a SentinelOne Singularity Endpoint sensor to block all threats that can come into the devices, and we have some interconnection with our SIEM and SOC company to ensure that we will not miss any threat.

We are also using SentinelOne Singularity Endpoint to realize the flow of which devices are trying to contact to ensure that no external compromised flows are used by collaborators.

The best feature for me in SentinelOne Singularity Endpoint is the granularity of the policy that we can have. As you might know, the ADEO group is quite big with several business units, and each business unit will have its own policies. Our main issue at the beginning of the project was to deal with these different business units, and we had the opportunity with SentinelOne Singularity Endpoint to specify very granular policy for each business unit.

This granularity in SentinelOne Singularity Endpoint will offer us more control because each business unit will have its specific business capacity, which can trigger some alerts. We will have to add some whitelist and sometimes some blacklist to ensure to catch all of the threats on the group.

Another feature is the possibility to have some dashboarding directly on SentinelOne Singularity Endpoint. We had in the past other tools, and the dashboarding part was not as good as SentinelOne Singularity Endpoint, so we are really enjoying this part.

Thanks to SentinelOne Singularity Endpoint, the ADEO group can manage all sensors for all business units instead of having different EDR spread across all the business units. In the past, we had three or four different EDR; now we only have one SentinelOne Singularity Endpoint for our group, and we have the opportunity to keep the management in SentinelOne Singularity Endpoint by ADEO, with all business units able to manage their own deployment of the sensor and policy management.

SentinelOne Singularity Endpoint has helped us consolidate our security solutions by providing a complete overview of all of our devices. We deployed SentinelOne Singularity Endpoint in servers, point of sale, workstations, and so on. Thanks to the SentinelOne Singularity Endpoint solution, we now have a complete overview of all of our devices, their level of security across the business unit, and in one dashboard, we can manage all alerts and threats retrieved by SentinelOne Singularity Endpoint.

The UX in SentinelOne Singularity Endpoint can be quite difficult sometimes. We had in the past other EDR, and sometimes the former EDR was simpler than SentinelOne Singularity Endpoint, so at the beginning, it can be really complex to understand how it works, how to manage the policies, and how to handle the RBAC. We had to follow the documentation and the different knowledge transfers offered by SentinelOne Singularity Endpoint, but we are quite good now, so we can manage SentinelOne Singularity Endpoint by ourselves.

Except for the UX part of SentinelOne Singularity Endpoint which can be time-consuming, I do not have any other improvements to share.

I chose eight out of ten because even if SentinelOne Singularity Endpoint is quite good in our day-to-day works, there are some improvements needed, especially on the UX part. The UX part is really important for us because we have some turnover in the cybersecurity team, so we would like to be sure that newcomers can handle SentinelOne Singularity Endpoint quickly, and sometimes we have to share knowledge transfers, which can be time-consuming.

I have been working in my current field for more than ten years.

SentinelOne Singularity Endpoint is stable; so far, we did not have any issues with it.

So far, we have more than one thousand devices, with a total of one hundred thousand devices deployed, which indicates that the scalability is really good because we did not have any issues.

The customer support for SentinelOne Singularity Endpoint was great; as soon as we had an issue, they were able to answer our questions.

We used another solution for the whole group, but we were not satisfied with the log management offered and found it less effective with threat detection.

We had the opportunity to interconnect SentinelOne Singularity Endpoint with our current SOC and SIEM tool, and the interconnection was really great and easy. SentinelOne Singularity Endpoint can offer some direct connectors, and we used one of them to ensure that everything can be configured quickly and easily, so we were really satisfied with this part.

SentinelOne Singularity Endpoint really reduced the number of threats. SentinelOne Singularity Endpoint reduced our MTTD by roughly forty percent. It reduced our MTTR by roughly thirty percent, depending on which business unit you are dealing with because some business units do not even have any cyber expert, making the alerts more complex to handle.

The experience with the pricing in SentinelOne Singularity Endpoint can be quite difficult to understand because there are several licensing lines, and sometimes it can be complicated to know which lines will be used. Thanks to the help of the SentinelOne Singularity Endpoint team, we had a great test offer to follow our needs. Compared to our previous solution, the licensing part of SentinelOne Singularity Endpoint was less expensive, so we saved some money.

We only evaluated one other solution, which was Trend Micro.

I would advise others looking into using SentinelOne Singularity Endpoint to ensure they have some experts able to manage the configuration of the product because it can be really difficult to manage. I would rate SentinelOne Singularity Endpoint an eight out of ten.