Our use case primarily involves using SentinelOne Singularity Complete for other clients as an EDR to monitor endpoint-related alerts, including malware and any malicious files, ransomware files, and any attack on endpoints such as servers or laptops. We use it as an EDR.
SentinelOne Singularity Platform
SentinelOneExternal reviews
310 reviews
from
and
External reviews are not included in the AWS star rating for the product.
AI-driven endpoint defense has reduced false positives and now speeds incident response
What is our primary use case?
What is most valuable?
SentinelOne Singularity Complete has behavior-based AI that detects alerts that are not predefined without relying on predefined rules. For example, it detects zero-day attacks or any behavioral changes in the baseline of the user, or any suspicious anomalies through AI-based threat detection only.
In terms of SentinelOne Singularity Complete's ability to ingest and correlate across our security solutions, when using this AI SIEM, it provides any incident in a unified view only. It correlates and gives the information in one view rather than requiring access to other data sources. It connects the dots and gives a complete, correlated incident.
With SentinelOne Singularity Complete integrated with AI, false-positive alerts have been reduced significantly. I can say that 50% of false-positive alerts have been reduced, and we mostly get true positive alerts. I cannot say 100%, but the false-positive to true-positive ratio has been reduced by 50%.
What needs improvement?
We do not currently use the Ranger functionality option as it has not been enabled by our organization.
SentinelOne Singularity Complete itself is somewhat laggy and loads slowly at times. Sometimes when there are alerts in the dashboard, we cannot see them and it shows zero alerts. In this case, we have to log out and log in again and refresh it before we can see the alerts. We also experience some flickering issues. The UI needs significant improvement. In this case, I would rate it around 6.5 to seven on stability and performance.
For how long have I used the solution?
I have been using SentinelOne Singularity Complete for one year and two months.
What do I think about the stability of the solution?
The mean time to detect with SentinelOne Singularity Complete depends on AI automation as well. Mean time to detect does not process for more than three or four seconds. We get real-time alerts that arrive as incidents occur. The product is performing very well in terms of MTDD and MTTR.
What do I think about the scalability of the solution?
Scalability for SentinelOne Singularity Complete is good. It works well with all the endpoints, even if there are large numbers of endpoints. For example, in an enterprise environment, it performs well. Proper configuration and policies need to be set, but overall it is effective. I would rate it around 8 out of 10 for scalability.
How are customer service and support?
Technical support is good. I would rate it 8 out of 10 because there is a feature of AI support. If we require any help with documentation, we receive it immediately. With a single prompt, we receive help with documentation, and those documentations are very clear.
Which solution did I use previously and why did I switch?
I have previously used CrowdStrike. I can say SentinelOne Singularity Complete is better than CrowdStrike because it is more AI-capable and integrated. It gives us alerts based on behavior using the AI. In this aspect, I have only used CrowdStrike as an EDR, and I can rate SentinelOne as better than CrowdStrike.
How was the initial setup?
Deployment of SentinelOne Singularity Complete is easy. Installing agents is straightforward. We can do it using Active Directory and group policies. It is easy to install agents in endpoints.
What about the implementation team?
In my company, SecureIntelli, we are a team of 15 members with two leads. The 15 members use SentinelOne Singularity Complete on an everyday basis to monitor for our clients.
What was our ROI?
SentinelOne Singularity Complete saves 50% time for me and my team in responding to alerts, and it has reduced response time by 50%.
What's my experience with pricing, setup cost, and licensing?
SentinelOne Singularity Complete does not require any maintenance from our end. There is maintenance scheduled once a month from SentinelOne itself. We receive prior notification if there is any maintenance scheduled, but it does not take much time. The system will be offline for no more than five minutes. The security is still maintained during this time. If any alerts come or if anything is automatically remediated, it is taken care of in the backend.
Which other solutions did I evaluate?
I would recommend SentinelOne Singularity Complete over others. If they are using CrowdStrike, I can recommend SentinelOne Singularity Complete over that product. However, it requires some fine-tuning of policies and configuration. If that is done correctly, it works very well as an EDR.
What other advice do I have?
With Purple AI, it summarizes the alerts. Without much manual intervention, we can determine if it is a true positive or not by seeing the Purple AI alert summarization, what has been happening, what process activity is occurring, and what the user behavior is. It also provides recommendations on what to look for and what needs to be done to remediate the attack. This has helped us to respond to low and medium alerts very quickly, but it still requires manual intervention for high and critical alerts because Purple AI is not that accurate. Sometimes it gives more generic answers for any queries. In this way, we use Purple AI and it has benefited us.
I can say that with Purple AI, security is maintained in terms of data privacy. We cannot share it outside. I do not have much detail on this, but based on my experience, it is secure. There is no insecurity in using Purple AI and GenAI.
In terms of threat intelligence with Purple AI, it depends on the quality of the data that it is receiving. With AI analysis, it correlates with the threat intelligence databases, and if there are any matches, it shows whether the observable is a threat or malicious. It is very good in this aspect and it will be updating very frequently.
Purple AI summarizes the alerts in a very concise format. We can determine if it is a true positive or false positive by seeing a summary. Sometimes it is very precise. As it provides remediation recommendations as well, it is very helpful for us to respond in a shorter amount of time.
I am not sure about the financial aspect as I am in a technical department as an analyst and do not have much information on financial matters.
Overall, I would rate this product 8.5 out of 10.
Autonomous Threat Detection with Clear Visibility and Real-Time Protection
What do you like best about the product?
What I like best about SentinelOne Singularity Endpoint is its strong autonomous detection and response capabilities, which help quickly identify and contain threats with minimal manual intervention. The platform provides clear visibility into endpoint activities, an intuitive dashboard for investigation, and reliable real-time protection that supports efficient incident response in a SOC environment.
What do you dislike about the product?
One challenge with SentinelOne Singularity Endpoint is that alerts or events can sometimes reoccur even after they have already been mitigated, which may require additional verification and can add to alert noise for analysts.
What problems is the product solving and how is that benefiting you?
It helps solve problems related to malware detection, ransomware prevention, and unauthorized endpoint activities. This benefits me as a SOC Analyst by providing real-time threat detection and automated response, which improves incident handling efficiency and strengthens overall endpoint security.
Automation has reduced detection time and has simplified ransomware recovery with reliable rollback
What is our primary use case?
I work with Purple AI and utilize it in SentinelOne.
In my day-to-day activities, SentinelOne Singularity Complete detects malicious activity or dynamic or static activity very quickly within the console.
What is most valuable?
I have been working with SentinelOne Singularity Complete, which is scalable and easy to deploy for the solution and has strong automation.
The main features of SentinelOne Singularity Complete that positively impact my organization are the useful rollback features, the anti-tampering mode, and automated local version upgrades or downgrades.
The rollback features represent the most usable feature of SentinelOne Singularity Complete. When a machine is infected, I can optionally roll back to the earliest date, providing ransomware protection.
Apart from the rollback feature, the most valuable features include the Ranger functionality, which provides network and asset visibility or endpoint visibility. It ingests logs from network sources and captures any threats, including the IOCs.
Overall, SentinelOne Singularity Complete helps me consolidate my security solutions, as it provides strong automation, reliable support, and valuable rollback capabilities.
What needs improvement?
I would like to see improvements in the hashes function, particularly in the hashes tab, as multiple hashes are difficult to add in the correct format in SentinelOne Singularity Complete for Windows, Linux, and Mac.
I would like to see included SIEM functionality, with enhancement in log collection capabilities in SentinelOne Singularity Complete.
For how long have I used the solution?
I have been working with SentinelOne Singularity Complete for the last 2.5 years.
What do I think about the stability of the solution?
In terms of stability, I believe it is not prone to downtime; it is a stable solution.
What do I think about the scalability of the solution?
I find it easy to scale up when necessary.
How are customer service and support?
I evaluate the customer service and technical support of SentinelOne Singularity Complete as very supportive, with fast response times.
I have seen improvements in meantime to detect and respond, with detection times being very good, less than 15 minutes or even less than 10 minutes.
Which solution did I use previously and why did I switch?
I previously worked with Trend Micro for EDR, XDR, and endpoint solutions.
The key differences between SentinelOne Singularity Complete and Trend Micro include the biggest benefit of automation, where most functions are automated, including threat detection and auto-remediation rules.
How was the initial setup?
The initial setup of SentinelOne Singularity Complete was straightforward.
What was our ROI?
I have seen a return on investment with SentinelOne Singularity Complete solution, as it is very easy to understand and functions through one unified agent managing the cloud, SIEM, and EDR solutions.
What's my experience with pricing, setup cost, and licensing?
I find the licensing cost to be very cheap, and implementation is easy, making it so easy to deploy for customers.
What other advice do I have?
SentinelOne Singularity Complete has helped reduce my organization's meantime to detect by minimizing false positives, especially for hashes and IOC blocklist functions.
It is the best method for reducing alerts through the exclusion method in SentinelOne Singularity Complete.
I use the SentinelOne Singularity Complete Ranger functionality.
Ranger in SentinelOne Singularity Complete reduces alerts by capturing different telemetry from the network devices, which is important for my organization as customers mainly use it for both public and private networks.
I don't have specific data to share, but it helps through exclusion and performance-based interoperability to reduce alerts.
Regarding time saving, I find that SentinelOne Singularity Complete helps free up my staff for other projects and tasks as it is a very good product compared to other solutions.
My recommendation for organizations considering SentinelOne Singularity Complete is particularly on the hash part, especially for Linux.
Overall, I would recommend SentinelOne Singularity Complete to others, as I find the solution very good and easy to understand. I have given this review a rating of 9.
Which deployment model are you using for this solution?
Hybrid Cloud
If public cloud, private cloud, or hybrid cloud, which cloud provider do you use?
Amazon Web Services (AWS)
Endpoint protection has reduced ransomware impact and streamlines daily threat hunting
What is our primary use case?
I used SentinelOne Singularity Complete for endpoint security, and we selected it because we were looking for an AI-powered cloud solution.
What is most valuable?
The best features of SentinelOne Singularity Complete include a ransomware rollback feature that can be used on infected machines, which we have used before and appreciated. The deployment is fairly straightforward as well.
SentinelOne Singularity Complete's ability to ingest and correlate across our security solutions has not presented any problems. This capability provides a benefit when hunting for threats and leveraging the AI side of the platform.
Regarding alert reduction, I would not say the impact has been massive. One of the negatives we have found is that we receive quite a lot of false positives.
Overall, SentinelOne Singularity Complete saves me time, and I would say the time savings are approximately 10 to 15 percent.
What needs improvement?
The reporting in SentinelOne Singularity Complete could be improved as it is still somewhat clunky and lacks customization. Support response times could also be better.
For how long have I used the solution?
I have been using SentinelOne Singularity Complete for approximately 18 months.
What do I think about the stability of the solution?
I would rate the stability of SentinelOne Singularity Complete as an eight out of ten.
What do I think about the scalability of the solution?
I would rate the scalability of SentinelOne Singularity Complete as an eight out of ten.
How are customer service and support?
I would rate the support of SentinelOne Singularity Complete overall as a six out of ten.
Which solution did I use previously and why did I switch?
SentinelOne Singularity Complete was already in place when I joined.
How was the initial setup?
The deployment of SentinelOne Singularity Complete was straightforward and easy. It took approximately one day to implement SentinelOne Singularity Complete, based on the number of clients we had.
What's my experience with pricing, setup cost, and licensing?
Regarding pricing for SentinelOne Singularity Complete, on a scale where one is cheap and ten is expensive, I would rate it as an eight.
Which other solutions did I evaluate?
When comparing SentinelOne Singularity Complete with other vendors, we use it for client-specific purposes, while other clients may use Microsoft or similar solutions. I have noticed it works well.
What other advice do I have?
SentinelOne Singularity Complete has not helped us consolidate any security tools that I am aware of.
We do not use the Ranger functionality in SentinelOne Singularity Complete as we use other solutions for that purpose.
Maintenance of SentinelOne Singularity Complete is straightforward to perform. Approximately 60 users use the solution, and all users are local. SentinelOne Singularity Complete requires some maintenance as part of our internal checks to ensure policies are up to date, which we perform on a weekly basis.
We do not use Purple AI.
My advice for others looking into purchasing SentinelOne Singularity Complete is that I would definitely recommend it. I would rate this review an eight out of ten overall.
Automation has reduced alerts and freed the soc team to focus on faster incident response
What is our primary use case?
The primary use cases for SentinelOne Singularity Complete include endpoint security to detect, prevent, and respond to cyber threats in real-time using AI-based behavior analysis.
The second use case is that the SOC team will investigate incidents, automate response actions, and protect systems from malware and ransomware.
How has it helped my organization?
SentinelOne Singularity Complete has helped me consolidate my security solutions, and there is some improvement overall. SentinelOne Singularity Complete is a good feature that requires skilled analysts and a proper plan for implementation. SentinelOne Singularity Complete is good for S1 analysts and is helpful for analysts with a simple GUI base.
SentinelOne Singularity Complete has helped reduce alerts for my organization. In my organization, we are an MSSP and right now we manage 6,000 plus endpoints and provide services to 10 plus customers because we are a partner with SentinelOne, and our customers are buying from us while we are providing endpoint services. All customers from us are very happy because the biggest difference is that SentinelOne Singularity Complete gives us the support team and the TAC team. There is human intervention between us and the TAC team because SentinelOne Singularity Complete is a SaaS product. If we get a false positive alert or if we get stuck anywhere, the TAC team will resolve that. The biggest advantage is the support from the TAC team to us, which is very helpful. If there was no TAC team, I would not advise using SentinelOne Singularity Complete.
SentinelOne Singularity Complete has helped free up my staff for other projects and tasks. I will tell you how SentinelOne Singularity Complete helps our SOC team. First of all, we have implemented SOAR technology, the Shuffle technology, which is open-source. Whenever an alert comes on SentinelOne Singularity Complete, we have integrated the Shuffle SOAR technology. Automatically the alert will be killed and quarantined, and mitigating action will be taken from SentinelOne Singularity Complete. Before that, we had to raise the alert manually, but we integrated SOAR technology, and automatically the alert raises to the customer within one or two minutes. This reduces the false positive alerts. We give criteria for Sentinel Shuffle: if the alert is triggered and the hash value for that file is bigger than five seconds, a secondary vendor will mark it suspicious or malicious, and we will raise the alert. Before implementing this, we had to manually check and explore and manually check deep visibility to determine where the alert came from or what scheduled task was generated. After implementing SentinelOne Singularity Complete with SOC as Shuffle SOAR, it is reducing the time significantly.
What is most valuable?
The best features from my perspective are that SentinelOne Singularity Complete includes EDR, XDR, and next-generation SIEM, and additionally, they have also added Purple AI. SentinelOne Singularity Complete is an automated tool with minimal interactions required. Everything works if we install the endpoint SentinelOne Singularity Complete agent on the endpoint. We don't require anything else because all the work will be done from the SentinelOne Singularity Complete agent that conducts real-time monitoring. If malware is detected, the agent will take care of its kill and quarantine and automatically send the alert to the dashboard.
If the agent is online or the desktop is online, it will connect to the dashboards, and we will get the alerts. That is the best feature. The second feature is the rollback feature for Windows, such as VSS rollback feature. If the endpoint is malware infected, we can restore our files and important data. These are the two best features I appreciate about SentinelOne Singularity Complete.
My impressions of SentinelOne Singularity Complete's ability to ingest and correlate across security solutions are that they can ingest logs from all over the device. For example, we have integrated the Shuffle open-source SOAR tool that ingests the logs from that Shuffle tool. Second, we have also integrated different firewalls and additionally, we have integrated the AWS cloud. Ingestion is seamless and awesome from SentinelOne Singularity Complete.
Regarding the role Purple AI plays in amplifying team knowledge, I use Purple AI for advisory and IOC purposes in my organization. I explore it for research purposes and find it very good and fast for sending advisories every week regarding vulnerabilities found. I don't use Purple AI much for other uses because I have limited exposure to it.
What needs improvement?
Regarding mean time to respond, the improvements I see with SentinelOne Singularity Complete are that genuine files also get alerts. We are getting false positives, but we are also getting genuine true positive alerts. The improvement will be deep visibility because as I am using Splunk as a SIEM, I compare deep visibility with Splunk, but deep visibility has limited access with only a 14-day policy to retain logs. The improvement will be in overall policy management. The third point will be the complexity of policies. If we want some endpoints to use only USB or if we need to block USB on some points, the policy management is very complex. The fourth point will be that Mac OS and Linux don't have the rollback policy; that policy is only for Windows. These four points are improvements if SentinelOne Singularity Complete can address them.
Data privacy and security when utilizing Purple AI is crucial for SentinelOne Singularity Complete, and SentinelOne Singularity Complete lacks in data security. Data security is very important in this world. In my organization, if we deploy SentinelOne Singularity Complete and we have integrated all the firewalls, all devices, and AWS devices to SentinelOne Singularity Complete, logs will be forwarded to SentinelOne Singularity Complete through SentinelOne Singularity Complete. However, SentinelOne Singularity Complete doesn't have data security solutions such as Forcepoint DLP or 48 layer; SentinelOne Singularity Complete doesn't have that DLP solution. From the data security point of view, SentinelOne Singularity Complete is not good.
For how long have I used the solution?
I have been working with SentinelOne Singularity Complete for 2.3 years.
What do I think about the stability of the solution?
In terms of stability and scalability, I heard the news that 25,000 plus endpoints can be installed in one go, so scalability is very good. Regarding stability, I haven't heard of any issues with SentinelOne Singularity Complete. Before two years ago, we heard about a blue screen issue with CrowdStrike, but I haven't heard of such issues with SentinelOne Singularity Complete. Stability is important because even if the agent disconnects from our console, it will still protect the desktop or laptop. There aren't many stability issues; the agent handles everything including upgrades.
How are customer service and support?
Regarding the technical support and customer service teams, I rate them 10 out of 10 on a scale of 1 to 10. The TAC team, which is available 24/7, is the reason for this rating. We are now in India, but if we get stuck at midnight, any other TAC team will be in GMT or Europe or America, and they will assign our support engineer and suddenly schedule a call for us and resolve the issue. The TAC team plays a major role and is very important for us.
Which solution did I use previously and why did I switch?
Regarding cost-effectiveness and ROI, I will say it is cost-effective. In India, before the installation of SentinelOne Singularity Complete, all our organizations used CrowdStrike, which is a competitor to SentinelOne Singularity Complete. After SentinelOne Singularity Complete came into the picture, the cost is more competitive, and the cost of SentinelOne Singularity Complete will be cheaper than CrowdStrike. I also have some exposure to CrowdStrike, so from a price perspective, I would prefer SentinelOne Singularity Complete if my organization has a limited budget for EDR or XDR solutions.
How was the initial setup?
Regarding the initial setup, I can say it is very easy to set up. We just need to create one tenant from my customer name and send and install the packets for Mac OS, Windows, and Linux servers. We take remote access, and within 5 to 10 minutes, one endpoint will be installed, although it takes some time to connect to the dashboard. The setup is very straightforward, and we have installed over 500 agents in one day. That is a very fast process we have accomplished.
What about the implementation team?
For the deployment model, my organization has a tie-up with Amazon Web Services, AWS. We are using the cloud because of that tie-up with AWS.
What's my experience with pricing, setup cost, and licensing?
Pricing-wise, it is very price-sensitive. My customers, enterprises, are buying from us. For small and medium enterprises, it is very costly. The pricing is approximately $7 to $10 per agent per month. My organization selling depends on the size of the endpoint we are dealing with, but the price is around $7 to $10 per agent per month. In terms of functionality compared to other EDR tools, it is the best price.
Which other solutions did I evaluate?
Regarding the key differences, both pros and cons of SentinelOne Singularity Complete compared to other technologies such as CrowdStrike or other EDR and NMI products, I have several pros and cons to discuss. The first pro is the fast response. The EDR will immediately get the malicious file, kill or quarantine it, and send the alert to our dashboard. The second is the rollback capability, which is a beautiful feature SentinelOne Singularity Complete gives us for Windows desktops and laptops. The third pro is the automation; 90% of actions will go through the agent. The agent will take all actions—kill, quarantine, alert—and everything is automated; we don't require anything else from our side.
However, cons would include the high false positive alerts; we get alerts for genuine files, and that creates noise, though we can whitelist it. Additionally, there is resource consumption; SentinelOne Singularity Complete uses more disk resources, which reduces the functionality of the desktop. The third con is that when we install the SentinelOne Singularity Complete agent, it takes time to reconnect to the dashboard due to network issues, and it can take 5 to 10 minutes for the endpoint to reflect.
What other advice do I have?
Regarding SentinelOne Singularity Complete's Ranger functionality, I am an L1 analyst and I don't have much hands-on experience with Ranger, but I know that the Ranger is used for detecting rogue endpoints in our network. The Ranger functionality includes network discovery and control features. These two features are very important in Ranger because it ingests logs from network sources and captures the threat matrix including IOC. The most important functionality will be the Ranger's ability to detect rogue device detection. I cannot confirm that we can use Ranger to completely reduce the alerts because I don't have that heavy work as I am only an L1 analyst doing some basic admin tasks.
Additionally, right now we are implementing the next-generation SIEM of SentinelOne Singularity Complete, but this is in the initial phase. Regarding mean time to detect, SentinelOne Singularity Complete is immediately detecting the alerts and giving them to us on the dashboard. The problem is that when we install the agent on the desktop, it takes some time to show on the console. Otherwise, the agent is seamlessly running in the background; while the user is doing their job on desktops, the agent is doing its job greatly in the background.
For threat investigations, I don't have exposure because I am L1, and right now, I have L2. One of my seniors, a senior forensic analyst, uses Purple AI for threat investigation. I don't use Purple AI for threat investigation; I just use it for searching IOC.
For advice or recommendations for organizations considering SentinelOne Singularity Complete, I suggest that before implementation, first, train your SOC on how to handle alerts and investigate. When I started with SentinelOne Singularity Complete, my manager told me to sit with the MBA team and learn about it, which was confusing at first. Start with the pilot deployment instead of deploying thousands of endpoints at once; install a few endpoints to check the performance. Third, integrate SentinelOne Singularity Complete with all your SIEM tools or SOAR tools. We as customers integrate SentinelOne Singularity Complete with Shuffle SOAR and get benefits such as triggering alerts quickly, so implementation is crucial for SentinelOne Singularity Complete to be a powerful tool. Training SOC, proper configuration with skilled analysts, and a well-defined strategy are the key recommendations.
I rate this review 9 out of 10.
Advanced endpoint protection has reduced alerts and has enabled rapid rollback and threat response
What is our primary use case?
My usual use cases for SentinelOne Singularity Complete revolve around EDR and XDR, focusing on protecting end machines, including servers, particularly for users with critical applications running on endpoints. It is crucial for them to know how to protect those systems. If at any point phishing or an attack happens, I can provide data protection and restoration to my customers. Those are the primary use cases.
The feature I find most valuable in this solution is its rollback feature.
What is most valuable?
The rollback feature is incredibly valuable because if my organization gets hacked, I can restore complete data from up to half an hour back by clicking a one-click rollback option available in SentinelOne Singularity Complete.
SentinelOne Singularity Complete's ability to ingest and correlate across my security solutions is significant. It correlates with all other services, for instance with Netskope or Forcepoint. It also correlates with Proofpoint and many other endpoint machines like CyberArk, which is PIM/PAM, along with Netskope, Forcepoint, and Proofpoint, which involve DLP.
SentinelOne Singularity Complete helps me consolidate my security solutions overall, though the consolidation only happens at the endpoint level, not at all levels.
My impression of the Ranger functionality in SentinelOne is that it is a good product that is helpful for my AD environment. It effectively protects my AD machines in that environment.
In my experience, SentinelOne Singularity Complete helps reduce alerts significantly. If any machine comes up, I will receive a notification. So in a day, I might get a thousand emails or alerts. What Singularity does is filter those alerts and provide me with the top 10 or top 15 threats to understand and mitigate the risk. That is a lot of help from Singularity. The reduction in alerts has been around 60 to 70%.
What needs improvement?
SentinelOne is definitely improving, with a lot of new versions coming out and patches happening on a regular basis. They are acquiring a lot of AI companies and conducting R&D backend work, which is ongoing. By the end of this year, I believe a fully-fledged product will be available. One area needing enhancement is on the commercial front, especially considering the major competition with CrowdStrike. Hence, we must address some challenges, at least for the Indian market.
For how long have I used the solution?
My experience with SentinelOne Singularity Complete spans four years.
What do I think about the stability of the solution?
I can rate how stable and reliable SentinelOne Singularity Complete is as a 9.
What do I think about the scalability of the solution?
I can rate the scalability of SentinelOne Singularity Complete as a 10. Whether it is 50, 5,000, or 5 lakh endpoints, it remains scalable.
How are customer service and support?
I do not often communicate directly with the technical support of SentinelOne, but my technical team does.
I would rate SentinelOne's technical support as an 8. Sometimes I get a response from them, but at times they may not have answers and defer to the engineering team, which can prolong the resolution time beyond expectations for customer satisfaction. Overall, it takes a couple of days longer than desired, but the rest of the service is good.
Which solution did I use previously and why did I switch?
Before my experience with SentinelOne Singularity Complete, we worked with different technologies such as Trellix and Trend Micro.
How was the initial setup?
I usually participate in the initial setup and deployment of SentinelOne Singularity Complete.
I can describe the initial setup process, but I am not deeply involved in the technical details because my technical team takes care of that. I am mainly focused on the business side.
From my perspective, the initial setup is straightforward. During a demo POC, they showcase the complete process, and the presentation along with the dashboard walkthrough helps the customer partner understand everything. It is not that complex.
What was our ROI?
SentinelOne Singularity Complete has positively impacted my company by being hassle-free. It provides good ROI, which stands for return on investment. It gives the best security, ensuring that if anything happens, I can utilize the rollback feature. Moreover, it offers a lot of integration scope with other solutions. The agent is so lightweight that it does not cause any system slowness when in use, making everything good.
The ROI I have experienced is straightforward. If I want to buy it for one year or three years, safeguarding it for three or five years down the line means my investment reduces. That is nothing but the ROI. Additionally, if I engage five engineers for this project and implement SentinelOne, then only one resource is needed to manage the dashboard and criticality alerts. This is how ROI materializes in my organization.
Which other solutions did I evaluate?
The decision to switch from the previous solutions was primarily driven by customer base comfort, customer adoption, and market responsiveness. Since SentinelOne is relatively new in India, having been around for five years, the customer adoption rate and ease of use made it easier for many customers to agree to replace Trellix, Trend Micro, and others. This led to a significant switch on their part.
What other advice do I have?
SentinelOne Singularity Complete has definitely helped free up employees for other projects and tasks, both for me and for my customers.
SentinelOne Singularity Complete has greatly aided in reducing my mean time to detect. It is actually very fast because the agent works as an AI agent. It detects any kind of malicious activity or threat in a pretty fast way. It is very fast, and as it is an AI agent, it runs automatically, ensuring rapid detection.
Regarding the mean time to respond, my time is getting reduced by 80, 85, or even 90 percent, which is good.
When considering stability and reliability, if CrowdStrike can replace Trend Micro, then similarly, if SentinelOne can replace Trend Micro and Trellix, the same way CrowdStrike could potentially replace SentinelOne, indicating that the market remains highly flexible.
Based on everything I have described, I rate SentinelOne Singularity Complete as a 10 because I have to promote it, so I present it as my best product.
Autonomous threat hunting has reduced false positives and now restores systems after ransomware
What is our primary use case?
SentinelOne Singularity Complete is an XDR solution for endpoint protection and EDR. I am an integrator and reseller of both their SIEM and XDR platform.
SentinelOne also has an AI SIEM that operates as a different solution on top of the XDR platform, which is very useful especially for organizations that do not have any SIEM but already have the XDR platform. With the XDR platform, I am able to correlate data from other solutions.
Their AI SIEM consolidates everything under one platform. The way it is very easy is that one agent does everything. Whether it is cloud, on-prem, or endpoints, one agent handles that part. If you have the SIEM as well, you can ingest logs from your cloud workloads, from your on-prem devices, whether it is a security device or other devices like your network switches and applications. It is able to ingest data from all platforms.
SentinelOne Singularity Complete is your endpoint platform that covers everything. It covers Linux, Mac, and Windows environments as well as your cloud workloads and Kubernetes workloads. If you are looking to integrate other solutions or devices, you need the AI SIEM, which will take care of third-party solutions, firewalls, identity access, PAM, and other integrations. If you want to bring those feeds onto that platform, you need the AI SIEM part for it. In terms of XDR, it covers the major platforms including Linux, Windows, and Mac.
The Ranger functionality is good, though I believe they have renamed it recently. If you want to do network discovery on your network to know what is running on it, Ranger is very good.
Purple AI is built into SentinelOne Singularity Complete platform. Purple AI helps engineers perform threat hunting without requiring SOC analyst experience. You are able to threat hunt and respond to threats using normal language conversation.
Because you are able to converse with it using natural language, you are able to build out responses using Purple AI that it will enact autonomously.
It is priced by endpoint device, making it one of the well-priced solutions. It is not too expensive and is a very good enterprise solution.
What is most valuable?
The most valuable feature is rollback on ransomware and malware because it is one of the only solutions that can do real-time rollback on ransomware and malware.
With SentinelOne Singularity Complete, you have virtually 99.9% zero false positives, which means when it is doing its detection, it is very good at it.
Because the detection engine can be fully autonomous and AI-based, the IT team is not bogged down looking for threats or hunting for threats. Most of the threats will be detected and remediated autonomously, which makes it very useful.
Because of the false positives and the detection engine that it uses, it vastly reduces the detection time because it is AI-based.
Because it is autonomous, you have more or less instant response if it detects a threat.
What needs improvement?
It is doing most of the work currently. The only thing that would help complete the solution is the ability to execute and perform patching from the system since it is able to discover vulnerabilities and CVEs on the system. That is the one improvement that I have had from clients.
For how long have I used the solution?
Five years plus.
What do I think about the stability of the solution?
I have not had any issues personally. I do not know everyone's experience, but I have not experienced any yet.
What do I think about the scalability of the solution?
It is extremely scalable, so it is very good. I would rate it a ten out of ten. You can use it for very small organizations all the way to extremely large organizations.
How are customer service and support?
I have not had to contact them for troubleshooting. When we are doing proof of concept, I speak with the SentinelOne team. In terms of them having to come in and troubleshoot something, that has not happened yet.
The material is readily available for anyone, and mostly they have what I need. I do not need to refer anywhere else.
Which solution did I use previously and why did I switch?
The only new solution that I have added is SentinelOne, not any other.
How was the initial setup?
The setup is very straightforward and not difficult to do. All you need to do is deploy the agent onto the endpoint machines and then configure the detection and response policies. Other than that, it is not much and is very easy.
What about the implementation team?
Setup is normally done by SentinelOne, but deployment is handled by us. The setup is an online setup unless it is on-prem. For on-prem, I am involved, but most users will not get on-prem deployments. Cloud deployment is done by SentinelOne themselves, and then we come in to do the deployment.
Advanced automation has reduced false positives and streamlined threat hunting across endpoints
What is our primary use case?
SentinelOne Singularity Complete is being used comprehensively for all capabilities. It is being used for endpoint detection and response, and for XDR purposes. For example, Entra data is being ingested into the platform to get a more complete picture, and also for non-incident-based threat hunting.
What is most valuable?
The ability to ingest and correlate across various security solutions is impressive. It could be a bit more widespread, but fortunately it is using OCP, and the built-in Purple AI understands more and more of it. On a scale of one to ten, I would rate this a seven to eight.
SentinelOne Singularity Complete has helped me and my clients consolidate security solutions absolutely. I have clients who are no longer using old school SIEMs and they have moved everything into SentinelOne. It has been replacing old AV or non-performative EDR solutions.
The best features in SentinelOne Singularity Complete have to be Purple AI. SentinelOne has not been doing AI for only the past three years, but they have done it since they started. They do have a more realistic grasp on their technology. Using Purple AI, it is very easy to quickly get a grasp on your data, to get the data that you want, and get it properly formatted.
What needs improvement?
Writing the parsers for data ingestion can be a bit annoying in SentinelOne Singularity Complete. When you do not have a native integration, parsing to OCP or OCF can be a bit tedious. Nothing major aside from that data ingestion aspect.
For how long have I used the solution?
I have been using SentinelOne Singularity Complete since 2020.
How are customer service and support?
I would rate the technical support for SentinelOne Singularity Complete a nine.
How was the initial setup?
The deployment process for SentinelOne Singularity Complete is easy. The documentation for it is really well-made. I might have overengineered it a bit to always automatically deploy the latest version via the API, making it perhaps more complicated than it needs to be, but once you have it set up, you do not need to worry about it again.
The initial deployment for SentinelOne Singularity Complete depends on the size of the customer, but usually half a day for full deployment is very doable.
What other advice do I have?
I still work with SentinelOne Singularity Complete as well. I am partnered with SentinelOne.
I absolutely use SentinelOne Singularity Complete's Ranger functionality. It is awesome to get a quick grasp on shadow IT, to know what you really have in your environment and what you perhaps do not even know about, what is covered, and what is not covered. The quick rollout feature or the deployment feature via Ranger is differentiated. In my opinion, when you see a device not having SentinelOne Singularity Complete in the Ranger overview, that indicates an issue with the process. You can use the band-aid by quickly deploying it, but in my opinion, that is a band-aid and you need to look at the process first.
It is hard to put into numbers how much SentinelOne Singularity Complete has helped reduce alerts. If it was just a percentage, I would have to say 90% and above. SentinelOne Singularity Complete correlates alerts. If something is happening in the same general incident, it is added to that incident rather than being a new alert. I remember being in the rollout for a larger client and they had another solution still in place at the time. They were running simultaneously for a while. In their old solution, they got hundreds and hundreds of alerts for a single occurrence, 99% of which were false positives. In SentinelOne Singularity Complete, we had a single notification, a single alert, making it much easier to quickly work through and finish.
Regarding my false positive rate reduction, I would say roughly 80%.
SentinelOne Singularity Complete absolutely saves time for me and my clients.
In numbers, I would say 80%. It is a lot of automation, and you can trust in the product to pretty much work. After you have set it up, you can essentially leave it running until you get an alert. That can mean you can leave it alone for a couple of weeks, and that is completely fine.
I would say roughly 70% for how much it has helped reduce my mean time to respond. Getting the alert is only half the benefit. Being able to quickly get all the information you need and then make an appropriate decision is simplified so much. Going back to the topic of XDR, because you can integrate pretty much any data you want into the console. You do not have to have 20 different tabs open. You can have SentinelOne Singularity Complete open and that is it. You can have all the information right there, even within the threat page itself. That simplifies things so much.
So 70% for detection and 70% for response.
Regarding Purple AI, data privacy and security when utilizing AI are important, and it meets my requirements and needs. Every time I interact with someone who is not from Germany, it is always the topic of data security and privacy for Germans. I think Germans are a bit different on that topic. Purple really does meet all the criteria for that. There has never been a single complaint.
With Purple AI, I would assess the capabilities in providing synthesized threat intelligence or contextual insight at six to seven out of 10. There is room for improvement. In a lot of cases, it might just be seeing issues where there potentially are none. If you look at a single event, for example, it may give you the information that this might be threat-related, but when you look into the data, it might also not be. Generally, it does perform really well and if there is something definitely malicious in an event, it will tell you. There is room for improvement.
SentinelOne Singularity Complete helps streamline threat investigations by making it so easy. It is actually unbelievable. Anyone can get started. For example, I recently introduced a new apprentice to the threat hunting capabilities via Purple AI, and that same day he was able to use it because the barrier to entry is so low. You do not need to learn a new query language. You do not need to learn the syntax. You can get right to it and get started.
In my thoughts on pricing for SentinelOne Singularity Complete, it is cost-efficient, definitely. Being pretty much solely on the technical side, I am a bit removed from that.
I would compare SentinelOne Singularity Complete favorably with other solutions or other vendors. It is easy to set up. It is easy to administrate. As with all solutions, you do need to put some effort into the initial deployment. That is going back to the whole beauty of it. It is easy. It takes a workload away from your team. You do not need to worry about so many things after you have it deployed.
My clients have mainly deployed SentinelOne Singularity Complete in the cloud, on-premises, and hybrid models.
I deploy SentinelOne Singularity Complete for myself and for my clients using the cloud for the console, but the agents on all the endpoints.
It is super easy to maintain SentinelOne Singularity Complete. When there is a new agent version, I do ring testing, for example, I do an internal deployment first before I roll it out to my clients. New versions come out every couple months. Beyond that, if there is an arising issue, if a client starts using new software, that also may come up if there are issues in interoperability with SentinelOne. In banking software for example, that is a common thing. Beyond that, it is super easy to maintain.
My advice to those looking into SentinelOne Singularity Complete is to do a proof of concept. Do a small-scale deployment across all your departments. See how it performs and see if there are any issues.
AI-driven protection has reduced detection time and now provides complete endpoint coverage
What is our primary use case?
This is an Umbrella platform that provides endpoint security as well as cloud security and provides ingestion like identity and network protection. These are the use cases we work with our clients as per managed security services. It provides great endpoint and cloud security services.
How has it helped my organization?
With the AI-based capabilities and the high detection rate, the mean time to detect and mean time to resolve the complete dwell time is less on that particular point. This really directly helps in that area.
What is most valuable?
The feedback is very good. Detection time and mean time detection, all the security metrics like mean time to detect and dwell times, make SentinelOne Singularity Complete great from the Sentinel point of view. It also provides the MITRE ATT&CK metrics on the dashboard, which helps us to understand tactics and techniques.
There are multiple features such as network controls and device control. We can manage the device as well as detect any unprotected or rogue identity and rogue endpoints across the enterprise. All of these are great features from SentinelOne Singularity Complete.
It reduces the manual intervention time. It reduces the alert noise and now has the AI capabilities to drill down that particular event or incident.
What needs improvement?
In terms of enhancement, SentinelOne Singularity Complete may increase to include some agent for email protection.
For how long have I used the solution?
I have demo experience, not production work on the AI Purple where we can take the data from multiple vendors or from Sentinel, and it will provide the enhanced observability and visibility. I have a couple of demo level experiences because that product we are not using right now.
What do I think about the scalability of the solution?
Scalability is also a nine.
How are customer service and support?
Technical support is also good. I would rate it around nine. When we have any escalation or something, it is very helpful in that area.
How was the initial setup?
It is a simple process.
What about the implementation team?
We are the managed service provider, so we help our clients. Sometimes it requires some advanced level of configuration or implementation.
Which other solutions did I evaluate?
CrowdStrike is the main competitor, along with Palo Alto Cortex and Microsoft Sentinel. These are the three main competitors for the product range from SentinelOne.
It is very hard to compare on this point until we have any kind of detailed one-to-one comparison. It actually depends on the use case on how we are implementing and which services we are opting. SentinelOne provides MDR and EDR detection, so it is a very great portfolio when compared. However, every peer competitor is also evolving day by day, so it is very hard to tell on that point.
What other advice do I have?
It is helpful because it provides the data ingestion from other vendors also. SentinelOne Singularity Complete, from the end user perspective, provides the complete security protection, which is the first thing we are looking for. It has very few false positives. With device control, we can manage the device inventory as well as compliance as per the standard working. These are the features which SentinelOne Singularity Complete provides.
SentinelOne Singularity Complete is a very great product. Network discovery and device control and these features are very helpful for administrators and cybersecurity analysts to help the cybersecurity portfolio correctly.
I would rate this review a nine overall.
Custom rules have strengthened endpoint protection and reduced false positives for my team
What is our primary use case?
I create policies based on the regarding policy, which means I created custom rules regarding the use case and customer use case.
Most of my use cases are related to the event ID and the process event, so it is easy to use.
What is most valuable?
My impressions of SentinelOne Singularity Complete's ability to ingest data and correlate across the security solutions is that it is better for blocking the hash value and generating the rules manually. It is easy to use.
Overall, SentinelOne Singularity Complete helps me consolidate my security solutions, being the best in endpoint, cloud, and identity.
The best features in SentinelOne Singularity Complete are in the SIEM solution, including the block list in hash value block list and anti-tampering mode.
The best part of the Ranger functionality is that it helps find known and unknown devices, locate IoT devices, and determine how many agents have not been installed in SentinelOne, making it easy to count how many machines are not installed and find IoT devices.
SentinelOne Singularity Complete has helped reduce alerts for me, with the best part being the exclusion, as it has already marked most of the alerts in the cloud as false positives.
SentinelOne Singularity Complete has helped free up my staff for other projects and tasks.
What needs improvement?
In the SIEM solution, I would like to see improvements in the data injection process, as it is very fast, and the log collector option is very nice. However, there are issues in blocking the hash, which is complicated due to different segregation for Windows, Linux, and macOS, so I ask for an improvement in this hash blocking function and the manual generation of how many VSS snapshots.
For how long have I used the solution?
I have been working with SentinelOne Singularity Complete for the last two years.
What do I think about the stability of the solution?
The performance issue with SentinelOne Singularity Complete is very good, but the hash blocking remains complicated and generating many snapshots manually is a recurring challenge.
What do I think about the scalability of the solution?
I work with the Ranger functionality in SentinelOne Singularity Complete, which is used to identify known and unknown devices both in and out of networks.
How are customer service and support?
I evaluate the customer support team of SentinelOne Singularity Complete highly, stating that they provide good support with 24/7 availability.
Which solution did I use previously and why did I switch?
I decided to switch to SentinelOne Singularity Complete because it offers a single solution for the endpoint SIEM and singularity purpose, and the console is very easy to handle.
How was the initial setup?
There were challenges during the setup, particularly with the custom rule as the customer asked for application-level blocking that I did not fully understand.
What was our ROI?
The project time is not the means full completely solution but it saves up to 40 days.
What other advice do I have?
Apart from the escalation matrix, I have seen improvement in the mean time to respond, with critical alerts raised below up to 15 minutes and false positive alerts raised in up to one hour.
I mostly use the custom rule and small things for the event type, event query, and searching in event query, focusing on endpoint based solutions in SentinelOne Singularity Complete and the SIEM solution.
I would rate the technical support of SentinelOne Singularity Complete a nine.
I have no recommendations for improvement regarding SentinelOne Singularity Complete as a product or solution.
I rate this review a nine overall.
showing 1 - 10