SentinelOne Singularity Complete Reviews

It's pretty good. The best thing is it has a secure shell command that you can use to get into any endpoint and do some jobs. That's a pretty cool feature. 

It's pretty much the same as similar typical solutions. It is a CrowdStrike, or SentinelOne, or Windows Defender. They do the same thing. 

The pricing is pretty good. 

It's probably not that top-notch like CrowdStrike or Microsoft Defender. However, it's okay, it's not bad. 

The only problem I have is they don't manually review the threat files. That's the only thing I'm concerned about.

The support needs improvement. There are some limitations. 

I've used the solution for less than six months. 

It is a very stable product. There are no bugs or glitches, and it doesn't crash or freeze. It is reliable. I'd rate it a nine out of ten. 

No matter what software you use, you need to do some fine-tuning.

The solution is scalable. You can pretty much deploy to anywhere.

In terms of if we need to send them some actual threat, they cannot manually verify it. That's the limitation of the company. However, for Microsoft, or Symantec, or CrowdStrike, you can actually submit a threat file, then they can manually review it. That's the only thing I've found so far with SentinelOne. The support is not that good. Obviously, probably eventually, they will get it in one year or two years' time; however, right now, it's not there.

Neutral

I've used CrowdStrike, Carbon Black, and Microsoft Defender as well. 

SentinelOne, CrowdStrike, and Carbon Black do the pretty much same thing. It all depends on the money.

The good thing about Microsoft and CrowdStrike is they can detect the device based on the traffic they're coming from. This is one of the advantages you have. With SentinelOne, this is where they're lacking. For example, for Windows Defender, if you're using your phone, you can figure out it's coming from your phone, or as long as it's coming to your enterprise network, you will know where it's coming from. This is one of the things I could not find in SentinelOne. You can only define it once you deploy it. However, without a proper deployment, you can't actually see it. For the other technologies, even though you don't deploy them, you can actually have a good understanding of the entire fleet and what's happening. For example, all emails are going to Office 365, so that's another way you get an excellent picture of the inventory assets. That's a very good NDM thing that you got it for free. With SentinelOne, they're not to that level yet.

The initial setup is easy. It's even simpler than, for example, Windows Defender. 

The maintenance is very low. It depends on how big the organization is. The false positive rate is very low. Obviously, it should be maintained by a team. Regardless, if it's Windows Defender, CrowdStrike, SentinelOne, or Symantec, it has to be built and looked after by a soft team.

For the functionality you get, the pricing is pretty good. I'd rate it four out of five in terms of affordability.

I was actually evaluating Windows Defender. I just want to check to see the selling points and the advantages of having Defender over Symantec products.

I didn't do a technical job; I just evaluated the product. I don't have a partnership with SentinelOne. 

I'd rate the solution seven out of ten. They are pretty good overall. 

In comparison to CrowdStrike, they use a lot of ICANN fees in the UI. But this isn't a problem for me because I am already familiar with CrowdStrike's interface and navigation panel. I still don't use the hamburger mini version of CrowdStrike because I am used to the old panels.

The rollback issue isn't marketed by CrowdStrike. I'm certain of it. We can, however, do it indirectly. If you want to do rollback in craft with RTR over Windows shadow copies, there is a workaround. 

This is an argument I occasionally use against SentinelOne. If you use rollback, your system has already been infected. CrowdStrike claims, that they don't do this, they are not a backup solution, and they don't allow any ransomware to work in their systems. 

By the way, rollback is a plus in the eyes of customers.

If CrowdStrike can do it with a single click, it will be a great turn of events.

The ability to get queries by pressing the "tab" button is a plus for SentinelOne.

SentinelOne makes it more difficult to define users.

It is difficult to manage users in SentinelOne.

There are many defining roles. It is granular, but it is also complicated. It is more granular than CrowdStrike, but it is not preferred because you have to check hundreds of roles. It's a challenge.

This user assignment feature would be more efficient. It would be fantastic if they could design it.

In comparison to CrowdStrike, EDR is less detailed. CrowdStrike provides more information about an adversary than SentinelOne.

Having a good EDR is a huge plus. In my opinion, it earns two points. The number will be nine if they can expand it with a more detailed one. 

I could complain about SentinelOne's pricing right now, but I am sure CrowdStrike is using its own staff to provide its clients with a complete solution. Being expensive is a little more reasonable than you think. 

Most people want to know why CrowdStrike is more expensive than other options.

CrowdStrike can assist you with their technical personnel, and CrowdStrike is the only provider who can assist you with their own threat hunters. SentinelOne is not currently doing this.

I have been using SentinelOne for three weeks.

I deployed it on my computer. I am testing it and trying to evaluate what is missing between the two products. I would like to see both of their advantages and disadvantages, which are not written. I am trying to gain real-life experience with these products. I have a lab. 

On these virtual machines, I have at least ten vendors. Some are legacy antiviruses, while others are next-generation antiviruses. I have worked with a variety of brands. These labs are being used for comparison.

I use automatic updates. As a result, it's most likely the most recent version.

The thing is, I can't say a thing about it because I need to digest a lot of data and launch a lot of attacks on SentinelOne, which I haven't done much of. Two or three assaults.

It was successful in prevention and detection, but I need to try some other methods to see if I can bypass SentinelOne.

This solution is currently being used by only two people. Myself and one of my teammates.

Not right now because things will be different in the real world, but we are only two computers with SentinelOne. So we didn't have that kind of experience right now.

When compared to CrowdStrike, the initial setup is more complex.

It only took me 10 minutes to install it on two PCs.

At this time it is only a trial. After the trial period, I am going to purchase two licenses from SentinelOne. To make comparisons too and continue investigating both products.

We simply want to compare in real-life conditions CrowdStrike, SentinelOne, Microsoft, and other legacy antiviruses such as McAfee, Micro, and so on.

If you are running an enterprise business, you should definitely go with CrowdStrike, but if you are on a tight budget, you could look into SentinelOne, but CrowdStrike is the better option. If you can stretch your budget.

If you need next-generation antivirus and EDR solutions or if your budget is limited, you can consider SentinelOne, but if you can increase your budget or convince your management to increase your budget, CrowdStrike would be ideal.

I am simply checking. I am not a customer. I am not a partner. I'm a CrowdStrike partner. I am only using it for my own needs. Because people frequently inquire about the differences between other brands and CrowdStrike. 

People come to me for CrowdStrike assistance. And I have to explain the key differences between the two products. And BattleKart does not accurately reflect the information. When compared to BattleKarts, the real-time experience is more valuable.

I would rate SentinelOne a seven out of ten.

We are a Dutch distributor working for Infinigate, a company specializing in distributing security solutions across Europe. One of our vendors is SonicWall. 

The instant rollback for Windows support is a nice feature.

Certificate distribution is quite easy, for example, using BitBucket SSL Inspection in conjunction with the firewall. More and more web traffic is via HTTPS, everybody is sending encrypted data, which needs to be decrypted for security purposes, then delivered. The integration of SentinelOne and the SonicWall Capture Client makes certificate distribution easy, which is needed for a SSL security setup.  

The 365 management and analytics from the cloud is another great feature.

It would be good to see some small tools to test files or hashes that are a potential threat, I know there are already products offering this.

We have been distributing this solution to our clients for two to three years.

The stability is fine, I haven't heard about any serious issues. 

Within the cloud, the solution is as scalable as required. The CapEX is quite low and you can scale this solution for thousands of users. 

Within our company, we use a Sophos product, as we have been working with them for 25 years and have a more established relationship. 

The initial setup of this solution is straightforward. As soon as you install it, the policy is sent from the cloud, and perhaps some certificates, and you are up and running, so that's relatively easy. I would rate the setup experience a four out of five, as there is always room for improvement.

When I open my browser, and I'm behind the SonicWall firewall without Capture Client my browser will tell me that I cannot browse the internet until I install the client. Then there is a button in the browser to install it, I click on it as a user, and after a few minutes, I'm up and running. Now I can browse again, but with a client, so it's pretty easy.

As a distributor, we advise our resellers and they sell it to their end customers, so most of the time the resellers implement. I often give demos and training, where I show them how to do it. From a distributor role, most of the installations are done by our resellers.

The CapEX is very low because you don't have to buy any management tools or install them on your hardware. It's all based in the cloud and comes with cloud advantages. 

Just buy the Capture Client and buy the installer itself in a license of 100,000, or whatever is needed. You don't need to invest in any management tools because they are already installed, and maintenance from the client will keep everything up and running. 

I would rate this solution an eight out of ten.

I would advise people to consider this solution, because the combination of SentinelOne and SonicWall Capture ATP is very powerful. I would also advise people to have a look at the Capture Client and test the differences with other AVs.

SentinelOne has a patented feature with a Sandboxing technique, they have four Sandboxing techniques. They also have an AI technique, machine learning from SonicWall, and millions of sensors around the world to detect threats and zero-day attacks. This corroboration of security threat data shared by everyone makes the solution a powerful security engine. As Capture ATP also works on the firewall, it's not only their AV clients who are feeding the machine learning and the threat data, but also their firewalls.

Our primary use case of this solution is to have as a next-generation security product for our endpoint devices. 

All of the features are valuable. The way that it integrates into management with fault correction capabilities over is especially valuable. Any of the full gamut of the features that it provides are useful to us.

In terms of improvement, I would like to see better alerting to let us know if there is anything wrong with SentinelOne working on the endpoint of the computer.

It's very stable. 

It's scalable. We don't have any plans to increase usage. 

We haven't had to engage with their technical support. 

We were previously using another solution and it was a corporate decision to switch to this solution. 

The initial setup was straightforward. The deployment took around two weeks. 

We did the integration in-house. 

We didn't evaluate other options before choosing this solution. 

I strongly recommend this solution. I would recommend that you get onto a next-generation endpoint security device like this one. It's much better protection for corporate environments particularly with a lot of cloud integration and platforms like Office 365. If you're going to start using those sort of services, then you really need a next-generation endpoint protection device like SentinelOne.

I would rate it an eight out of ten. 

We use SentinelOne as an endpoint protection solution.

The overall integration functionality for this solution could be improved. 

I have been using this solution for three years. 

This is a scalable solution.

The customer support for this solution is good.

The initial setup is straightforward.

I would recommend that anyone considering using this solution first understand exactly how this solution works and what their business needs. 

I would rate this solution a nine out of ten. 

We are an IT company that sells solutions, and this is one of the products that we provide to our customers. We work on certain opportunities that require the capabilities of SentinelOne, but we do not use it for our own purposes.

This solution is used to protect endpoints against malware and other threats.

A lot of the deployments are hybrid. In Lebanon, the cloud is not used to a large extent. Most of the customers use on-premises solutions.

The most valuable feature of this solution is the user-friendly interface. Our customers ask for something that is easy to use, easy to manipulate and doesn't require too much intervention. This is where SentinelOne scored big against CrowdStrike and Carbon Black.

This solution is easy to install.

This solution would be more attractive to customers if the price were lower.

The stability seems ok at this point because there is no negative feedback from the customers.

This solution is scalable and expandable with no issues.

We have support from both vendor and distributor, and up to now, it has been satisfactory. The response has been very good, which is something the customers really appreciate and is always considered a plus.

The initial setup of this solution is straightforward. The deployment is very easy and very fast, taking perhaps two or three hours, depending on the size of the project.

It is a centralized deployment.

A maximum of two people are required for the setup and maintenance.

The implementation of this project is a joint effort between our team and the vendor's technical team.

I have done POCs with this solution for two customers and there has been no negative feedback.

My advice for anybody considering this product is to do a POC and check to ensure it fits their environment. In some areas, this may be the best product to use, but in another environment, another product or another solution would be a better fit. It's always a matter of doing the POC and trying to get the most out of the product, depending on the environment.

I would rate this solution an eight out of ten.

Sentinel One has improved our organization by protecting the environment we are working in.

We had some stability issues when we started working with SentinelOne. 

I have been using Sentinel One for one year now.

Initially, there were a lot of issues that kept popping up. Now it has become stable.

It is definitely scalable. We have around eight to ten thousand servers.

I would rate SentinelOne a seven out of ten.

SentinelOne has completely replaced the antivirus solution that we used before. It's also an EDR solution. In the case of any suspicious malware, we can control the system with this agent.

Previously, we had some processes related to incident response which required more steps.  We needed to upload to VirusTotal, Sandbox, et cetera. Now, this process is shortened because all of the information we need is already in SentinelOne. We can briefly analyze and even respond from one management console. If someone has SOC, using the API, they can control everything. It's very cool. I think this is the future.

Behavioral AI does recognize novel and fileless attacks but we hope not to experience an attack like this. These days, there is no life without the internet. I don't think it is really a plausible scenario because we all use Microsoft services, 365, etc. If you don't have an internet connection, then you don't have anything. The guys from SentinelOne showed me an example where they can actually work without an internet connection and it worked just fine, like a common antivirus solution. But it wasn't important to us that it can do this because we know that in the real world, there are not many scenarios that wouldn't involve the internet.

We do use the storyline feature because it's SentinelOne's main feature that they are proud of. We don't see a lot of viruses in our environment and from what we have seen, it doesn't really help because a user will download a virus, the antivirus blocks it, and that's the end of the story. So there isn't much of a storyline behind it. But the SentinelOne guys showed us how it works and in the case of a difficult attack, it should work fine. 

We work with the storyline feature when we are suspicious of something and we need to check. But we didn't have an exact case where something highly critical was in our systems.

I find all of the features to be valuable. It's a cool and very informative tool. The management console analyzes, stops, and prevents the spread of malware. You only need to work with the console. There is nothing to do on the agent side. The user does not need to be involved in this process. 

The level of information it provides is enormous. You have all you need in case something happens. If we need to have an incident response with third-party external companies, we can give them the data that they can analyze further. The information about what's happened on the computer is absolutely amazing.

It's very comprehensive. It offers a lot of data but you can see only what you need or you can go further. If you need to investigate a little further, you can do that in any process. It's a SOC-analyst style.

If you are not an analyst, you can still do a lot with it. It's very convenient. We have workers who are not in the office, who are working from home. This is a good solution for them because it's Cloud-based. I can control everything from one console and even for users who are not in the office. We work with lots of vendors and not many of them have this solution. Traditional antivirus software doesn't have these features.

In terms of its impact on the endpoint, when you have a house computer working on antivirus, it doesn't make a huge impact on the system resources and even more, it can be installed parallel to antivirus. We have had scenarios where we have traditional antivirus and SentinelOne installed in parallel. It's two antiviruses on the computer and users won't know about it. They know about it when they start to download bad stuff and the antivirus starts yelling. 

According to what I see in the console, I do think that SentinelOne covers a wide variety of operating systems. It's even more than it needs to. In the traditional way, it's like antivirus but it does even more because it's also like an EDR solution. It covers all processes, what it does, where it goes, et cetera. There's a lot of stuff under the hood. I'm surprised it doesn't use a lot of resources because I thought it would be more aggressive for CPU memory.

In terms of improvement, they should work on agents' updates because that is not a strong part. It's not their strong point. It's not straightforward to upgrade agents. I send them questions about it. They already worked on this and they promised that in the next release that they will show me their solution for it. But this year I have had complaints about agents' updates, that they aren't clear.

They have a lot of updates on their management console. They have a lot of features. There is not enough time to read about it all. It's really a lot. The features that they apply are great and I would love to use them, but it's lots of things to know. And if you're not only working with antivirus on SentinelOne like me, there isn't much time to learn about it. 

I have been using SentinelOne for almost a year. 

I'm very excited to work with SentinelOne but they have a problem with agent updates. We lose connectivity when we update agents. When users are working from home it's not good to lose connection because you don't have options to connect or have meetings. 

I think they started working very closely on this problem. This solution will be better but so far, that's been my experience. 

We use the Cloud. It's completely scalable. They use a management console for lots of companies. It's tremendously scalable, it can be used with hundreds of thousands of computers.

Right now, we protect only 100 endpoints, it's for highly critical systems. Before the COVID crisis, we had plans to increase usage. We need to renew at the end of the year. We will for sure renew for 100 endpoints. I'm not sure about expanding though.

We don't need to do anything related to updating service backend sites. For agents, we only need to click "select all" and "run update," that's it. It only requires one person for maintenance, to see events and analyst information, technology, etc. It has access for three people who are security engineers and our CSO.

They have excellent support. There are security vendors who take up to 48 hours to just answer back a "Hello," without an explanation to my problem. The SentinelOne guys answer within the hour with a solution to any concerns expressed in an email. Support is very awesome. They also connect me with engineers who can help me. I can share a screen with them to show them the exact problem. This is important because a lot of vendors don't do this.

The initial setup is very easy and straightforward. We don't use the on-premise solution, we are Cloud-based. It's important because we have a lot of resources on our side who work fast. We can deploy in minutes. The initial deployment took one hour. 

We did the deployment ourselves. It's really easy. We have a Wiki page where end-users can see what they can install themselves. They just need to click on it, type, tell us where they want us to put a computer, and that's it. The users can do it themselves.

We installed it for a pilot group of 10 users and then deployed for others.

Our analysts spend less time doing his job because he has everything he needs in one management console. He can programmatically do everything and only react to real incidents. It reduced the costs of analysts' work. Their work costs a lot of time and money and having SentinelOne enables us to save on these costs. 

There are actually three versions of this product: the user version, professional, and professional plus. If analysts need to see something, like what the users are doing, what processes are running, we can go to the console and see. The traditional version only shows when incidents happen. I think the next time we renew, we'd go with the lesser version because it shows enough information. 

There aren't additional costs to the standard licensing.

We have the option to choose different vendors. We briefly looked at other vendors. We looked at Carbon Black, Kaspersky, and ESET EDR.

We evaluated them one year ago. These vendors are comparable to traditional antivirus while SentinelOne is and all in one solution. It has everything you need. SOC analysts is straightforward and they gave us a straightforward proposal. 

It takes the same amount of time for SentinelOne to catch malware as it does other solutions. There's not much of a difference. In our case, we don't see a lot of viruses because we have a lot of levels of security that prevent them. 

We can see the difference between traditional antivirus and what we can do with SentinelOne. Even if the price is a little bit more, we can see what we can do with it. We can use EDR, stop network activity, do whatever we need on the endpoint, from the security engineer side. We can see that it's at a completely different level. We have a traditional antivirus but we're going to rid of them at the end of the licensing period.

My advice would be to go with the Cloud version, not on-prem. 

I would rate SentinelOne a ten out of ten. It's a ten out of ten in terms of the EDR. It's also a 10 of 10 for the product and company. The solution does a lot.