SentinelOne Singularity Platform

My main use case for SentinelOne Singularity Endpoint is running the Picus Breach and Attack Simulation tool in our lab environment. After performing attacks on specific EDR tools, we understand which tools require which kind of exclusions to complete the attacks properly. We also determine how we can tighten the security policy, what kind of rules we can add, or which options we can tighten. After the prevention section, we can integrate with the API endpoint on SentinelOne Singularity Endpoint, and thanks to that, we can also fetch some logs and validate the operation in the detection side.

The best features that SentinelOne Singularity Endpoint offers include the EDR visibility. It helps me understand which kind of operation Picus has done on the system, the timeline, the process tree, and which kind of command has been executed. Thanks to that, we can write the proper exclusions or write the proper security tightening rules. The visibility provided by SentinelOne Singularity Endpoint is the best part.

On the integration side, we integrate SentinelOne Singularity Endpoint with Picus to collect the logs from the host where SentinelOne Singularity Endpoint is installed. We can collect the logs and the alerts related to the specific machines. In different products, we can see some delay on the ingestion time. After a couple of attacks, sometimes we lose some of the logs because the security solution only logs a couple of the attacks but not all of them. However, we did not encounter this issue on SentinelOne Singularity Endpoint. Each time we can access all the logs created by Picus itself, which means SentinelOne Singularity Endpoint does not miss the logs. We also did not encounter any ingestion time delay issues on SentinelOne Singularity Endpoint. In some other products, we can encounter logs that have been created after the attacks have been finished, long after the fact. We did not encounter this issue on SentinelOne Singularity Endpoint. I can conclude that SentinelOne Singularity Endpoint is good at logging and alerting.

SentinelOne Singularity Endpoint has positively impacted our organization in that we do not use SentinelOne Singularity Endpoint in the whole company. We are only using SentinelOne Singularity Endpoint on the lab environments to validate the Picus attacks. Based on our experience, SentinelOne Singularity Endpoint's score is high when I compare it with well-known EDR solutions. I can say that SentinelOne Singularity Endpoint is one of the good products.

I cannot think of anything to suggest to improve SentinelOne Singularity Endpoint. If I find something, I can create a feature request for them.

The reason I provide an eight for SentinelOne Singularity Endpoint is that it is easy to use and detection is faster than the other EDR products. There is no delay, ingestion delay, or missing logs on SentinelOne Singularity Endpoint. However, I do not provide a ten out of ten because when I compare it with different products, SentinelOne Singularity Endpoint is at the third position. This means that on the prevention side, it might be better. This is the reason I provide an eight. Additionally, when I log into the system, sometimes I encounter some problems. For example, it asks for username and password. After the username and password, it asks for the token, meaning the OTP, but it turns me back to the first page without any notification. I just enter username, password, and OTP again to log into the system. I do not know which kind of problem I encountered, and it just did not throw an error. Instead of that, it just turned me back to the login page. This is not a good issue. I also encounter some problems on the support side. When the policy override was first announced for the Breach and Attack Simulation tools, we as Picus provided some feedback related to the policy override because it does not work for Picus. We contacted the support team, provided our observations, and explained why it does not work and what kind of enhancement could be done. However, the support team ignored us and just said they would look at it. I am not sure whether anybody looked at it, because it did not change. Still, when sometimes we encounter a customer using the policy overrides instead of the exclusions suggested by Picus, they encounter the problem where SentinelOne Singularity Endpoint kills the Picus services. After we connected to the system, we understood that the customer was using the policy override, but the policy override does not work. Perhaps the support responsiveness might be enhanced.

I have been using SentinelOne Singularity Endpoint for approximately three years.

I notice that integration is faster with SentinelOne Singularity Endpoint. It is also a kind of product that is easier to use. In some products, I do not want to mention the names of them, but some of them are hard to use, whereas SentinelOne Singularity Endpoint is easy to use. I did not use SentinelOne Singularity Endpoint before starting at Picus. Even though I did not use it before starting at Picus, I easily got used to it because the UI is easy to use and everything seems clear. I only use SentinelOne Singularity Endpoint in the lab environment. We did not use it in the whole company. However, if we had been using it, we would have benefited from it. I can say SentinelOne Singularity Endpoint offers faster detection.

I looked at the console and I see some numbers related to the different EDR vendors for both simulation speed and also the result itself. SentinelOne Singularity Endpoint's score is demonstrated as the third highest score in the system. It is also the third speediest one. This means that overall, SentinelOne Singularity Endpoint has demonstrated good performance. I provided a rating of eight out of ten for SentinelOne Singularity Endpoint.

SentinelOne Singularity Endpoint actively monitors endpoints continuously whenever there is activity, and then correlates the events accordingly, and flags threats using a storyline.

It actively detects and monitors if anything suspicious happens on the endpoint, and then actively blocks it and raises an incident alert for the security team to review.

There was a recent incident where there was a modification of a VSS backup on a server endpoint. SentinelOne Singularity Endpoint actively detected that modification and raised an alert with us, and we quickly reviewed it. Although it was a false positive, it was a legitimate application that was trying to modify the VSS backup and delete and take a fresh backup from scratch. However, SentinelOne Singularity Endpoint actively monitored it and flagged it as suspicious activity. Though it was a false positive, the underlying activity was detected correctly.

Whenever it detects threats, it helps us respond to threats quickly because the EDR actively monitors the threat and blocks it. When there was suspicious activity at three o'clock in the night, SentinelOne Singularity Endpoint does not require active monitoring of the alert by the team. In that scenario, there could be a lot happening by the time when we see the alert, and the latent moment might have occurred since the start of the attack. SentinelOne Singularity Endpoint actively monitors the threat and then blocks the threat if any other suspicious attributes are being shown as part of the attack. This is the feature that I appreciate about SentinelOne Singularity Endpoint; it actively blocks the threat and once it blocks the thread, we can review it later on and look for more details, and we can unquarantine the thread if we feel it is a false positive, or we can take action accordingly. It actively blocks the threat from moving laterally.

The recent feature is the Prompt AI. Using that Prompt AI feature, we can get queries to build a quick summary. We can build a query using natural language processing, which means plain English text, and it gives the query accordingly, and it is going to be useful for us to threat hunt and actively identify threats. That is a good feature. The other additional feature is retrieving the files from the computer even though the machine is isolated through the shell. These are pretty good features that I have found useful.

It actively monitors the endpoints for any threats. There is no such EDR that could actively block any kind of threat in the world.

It consolidates the vulnerability management side by actively identifying the risk applications that have been running in the endpoints. We can do the threat hunting through the log collections from the endpoints and then actively write a query to identify the threat that has been running in the environment. It also does the network scanning and also a bit of the VSS management. We can manage the VSS backups as well, handling the VSS snapshot backups through that. It has been a pretty good product, and it could have more capabilities or additional capabilities as well.

For now, it has been pretty good. I could not think straight on top of my head what one feature could be added. But for now, the features that SentinelOne Singularity Endpoint offers are pretty great. However, I wish there could be patching that could be happening through the EDR so that we would not need to manage any other separate tool for patching those vulnerabilities since it actively identifies vulnerabilities. Maybe that feature could be helpful. I am not sure whether the single agent can uplift the bulk activity or not. That is one thing I wish I could add in SentinelOne Singularity Endpoint.

We need to set the guardrails for the Prompt AI because it actually queries the logs directly for whenever we want to search in the endpoint logs. Whenever we give a prompt to actively look for something, it actively queries directly inside the logs and returns the output directly instead of just giving a suggestion to go this way or do that way. It actively interacts with the application inside itself and provides results directly without showing the backend process. I am not sure about how the guardrails were set, but setting the guardrails for the AI needs to be taken care of. Since it has pretty much direct access to the endpoints and there are agent capabilities through SentinelOne Singularity Endpoint, we have to take care while handling or implementing AI.

I have been using SentinelOne Singularity Endpoint for over a year.

It has been good as far as I am concerned. If we have a good number of licenses, as long as we are near the limit, it is good.

I can understand that since there is a shortage of staff in SentinelOne, sometimes when we raise a case, it takes some time to respond. However, since we have the Prompt AI, things have been pretty easy for us to handle by ourselves instead of relying on tech support or customer support. The tech support does a great job whenever we raise a ticket.

We did evaluate CrowdStrike.

The impressions are pretty great. It has been actively blocking the threat and also correlates all the events using storyline, which has been pretty great.

It is going to be really helpful because earlier, I used to go through the documentation, and it used to take a lot of time for me to actively find the relative answer to the question. With the Prompt AI, I can just query my question to the Prompt AI, and then it actually returns the results in a better way. If I have any queries, I can reach out to Prompt AI instead of raising a tech support case. It saves a lot of time.

My suggestion would be to look at whether, based on the range of the products that we use, SentinelOne Singularity Endpoint supports those products or not, and then accordingly, we can purchase SentinelOne Singularity Endpoint and also evaluate how well it integrates with other security solutions inside our environment. I gave this review a rating of eight out of ten.