La principale force de SentinelOne demeure, selon mon expérience, son moteur de détection et sa capacité à réagir rapidement à certains comportements malveillants associés aux rançongiciels. La visibilité offerte par les événements de sécurité et les capacités EDR permettent d'obtenir davantage de contexte lors de l'investigation d'incidents que ce que nous avions avec notre solution précédente.

Au moment de notre acquisition, le coût était également compétitif par rapport à plusieurs solutions comparables du marché, ce qui a contribué à notre décision. J'ai aussi apprécié la richesse fonctionnelle de la plateforme, notamment les capacités d'automatisation, les fonctionnalités EDR et les outils basés sur l'intelligence artificielle qui semblaient prometteurs lors de l'évaluation initiale.

Dans notre environnement d'entreprise, ces éléments ont constitué les principaux avantages du produit. Review collected by and hosted on G2.com.

Après plus d'un an d'utilisation dans notre environnement d'entreprise, plusieurs aspects du produit demeurent problématiques pour notre équipe.

Le premier concerne l'interface d'administration. Malgré plus de 25 ans d'expérience en TI et en cybersécurité, je trouve encore certaines fonctions difficiles à localiser et plusieurs tâches quotidiennes nécessitent davantage de navigation que sur d'autres plateformes que j'ai administrées. Ce constat est partagé par plusieurs membres expérimentés de mon équipe.

Nous observons également un volume important de faux positifs, notamment lors d'opérations légitimes comme certaines mises à jour de pilotes ou d'utilitaires. Le temps requis pour analyser, valider et exclure ces événements réduit une partie des gains opérationnels attendus d'une plateforme EDR moderne.

Notre déploiement couvre plusieurs dizaines d'appareils Windows et la plateforme est administrée quotidiennement par notre équipe TI.

Concernant le support technique, les recommandations reçues ont souvent consisté à créer des exclusions plutôt qu'à approfondir l'analyse de certains faux positifs. Bien que cette approche permette de résoudre rapidement un incident isolé, elle ne répond pas toujours à la cause sous-jacente du problème.

Nous avons également rencontré certaines incompatibilités ou impacts sur les performances lors de l'utilisation conjointe avec d'autres outils présents dans notre environnement.

Enfin, certaines fonctionnalités que je considère désormais standard dans plusieurs solutions concurrentes, notamment le filtrage et la restriction web intégrés, ne sont pas offertes nativement dans SentinelOne. Cette absence nous oblige à maintenir des solutions complémentaires pour répondre à nos besoins de sécurité. Review collected by and hosted on G2.com.

What's provided the most value for me is the autonomous response. Running a mixed Windows/macOS fleet with a chunk of BYOD devices, I can't babysit every alert, and the on-agent behavioural AI catches and auto-mitigates threats without waiting on a cloud round-trip or an analyst clicking "contain". The Storyline attack visualisation is the feature I lean on daily; instead of stitching together process trees myself, I get the full execution chain mapped out, which turns what used to be a 30-minute triage into a few minutes of confirming and rolling back. AI / Intelligence: The static and behavioural AI models running locally mean detection holds up even when a device is offline, which matters for laptops that aren't always on the VPN. Fewer noisy false positives than the signature-based tooling I've used before. UI / UX: The console is clean, and the Deep Visibility query interface lets me hunt across the fleet quickly. Onboarding new admins doesn't require weeks of ramp-up. Performance: Agent footprint is light — I haven't had the user complaints about system slowdown that plagued our previous endpoint tool, which is a real win when you're deploying to BYOD machines you don't fully control. Integrations: Ranger for network visibility (surfacing unmanaged devices) plus the API and SIEM connectors have fit into our stack without much friction. Adding Ranger meant I stopped needing a separate discovery tool to find rogue endpoints. Support / Onboarding: Deployment was straightforward, and vendor support has been responsive on the escalations that mattered. Pricing / ROI: It is not the cheapest option, but the ROI shows up in reduced analyst hours; the one-click rollback on ransomware alone has justified the spend, and consolidating discovery (Ranger) into the same platform cut a line item elsewhere. Unexpected benefit: The rollback capability doubled as a safety net for my organisation during a legitimate-but-misclassified software push; being able to reverse endpoint changes cleanly saved a reimaging headache. Review collected by and hosted on G2.com.

The biggest pain point is policy and exclusion management at scale. Building exclusions is more manual than it should be; there's no clean way to test an exclusion's blast radius before it goes live, so tuning for a noisy line-of-business app on part of the fleet involves more trial-and-error than I'd like. A "preview affected endpoints" step or a staging mode for policy changes would cut real risk out of the process. Deep Visibility is powerful, but the query experience has a learning curve. The syntax isn't intuitive for newer analysts, and saved-query sharing and templating could be better. When I'm onboarding someone, threat hunting is the piece that takes longest to hand off, which partly defeats the "autonomous" pitch for smaller teams. Reporting is the other weak spot. The canned reports rarely match what I need for regulatory or management audiences, so I still end up exporting to build the view myself. More flexible, customisable reporting, or a proper report builder, would save hours each reporting cycle. On macOS, agent updates and OS-version compatibility have occasionally lagged behind Windows, which matters on a mixed fleet where I can't always hold back an OS update on a BYOD device. Tighter macOS parity would help. Console performance can also drag when pulling large time-range queries across the full fleet, and the alert volume before tuning is high enough that early days feel noisier than expected. Review collected by and hosted on G2.com.

AI-driven threat detection that effectively identifies ransomware, malware, fileless attacks, and suspicious behaviors in real time.

Autonomous response capabilities, including device isolation, remediation, and rollback for ransomware recovery, which significantly reduce manual effort.

User-friendly management console with centralized visibility across endpoints, making investigations and policy management straightforward.

Lightweight agent performance compared to many traditional endpoint tools, with minimal impact on end-user systems.

Strong visibility and forensic insights, helping security teams investigate incidents faster and improve overall security posture. Review collected by and hosted on G2.com.

SentinelOne Singularity Endpoint can be complex to learn initially, with a UI that isn’t always intuitive. It may require significant tuning to reduce false positives and optimize performance, and some users report occasional system slowdowns or legitimate processes being blocked. While powerful, it demands skilled management to get the best results Review collected by and hosted on G2.com.

What I find most helpful about SentinelOne Singularity Endpoint is its AI-driven endpoint protection, which leverages machine learning and behavioral analysis to detect and respond to threats in real time. It provides excellent visibility across endpoints, making it easy to investigate incidents and understand what's happening throughout the environment.

The user experience is easy to navigate and intuitive, and onboarding new endpoints is seamless. It also integrates well with other security tools to enable a centralized monitoring and streamlined workflow for IR. All of these ensure high performance. Review collected by and hosted on G2.com.

One downside I’ve noticed is the occasional false positives. They create a lot of noise in the environment, which ends up wasting time. Even when the same alert has been manually mitigated and flagged, it still repeats. Review collected by and hosted on G2.com.

Very intuitive tool, easy to use, with built-in Generative AI that greatly helps in solving cases. Remediation is simple and fast. In terms of resources, it requires little and is quickly deployed through other tools like NinjaOne RRM. The price is reasonable for the advanced capabilities the solution offers, and if you have any questions, the support team responds promptly and appropriately. Review collected by and hosted on G2.com.

Centralized console, easy to use and with many automations that make your day-to-day more efficient. Thanks to the incorporated AI, the tool helps you close cases under the law of least effort and gives you time for other investigations. Review collected by and hosted on G2.com.

What I like best about SentinelOne Singularity Endpoint is its behavioral threat detection and automated response. It detects suspicious activity quickly, isolates infected endpoints when needed, and provides a clear investigation timeline that makes it easier to understand and respond to security incidents. The management console is also easy to navigate, which simplifies day to day security operations. Review collected by and hosted on G2.com.

I think the sentinelone singularity endpoint platform is a great security solution, however fine tuning policies and creating exclusions for trusted applications can take some time, especially for larger environment. This can be improved on. Review collected by and hosted on G2.com.

SentinelOne Singularity Endpoint is one of the most effective and efficient EDR solutions I've used. It's highly proactive, with excellent real-time threat detection and automated response capabilities. The platform is reliable, easy to use, and provides great visibility into endpoint security. Review collected by and hosted on G2.com.

One area for improvement is the blocklist functionality. Currently, it only supports blocking file hashes, whereas I would like to see support for a broader range of indicators of compromise (IOCs), such as IP addresses, domain names, and URLs. Review collected by and hosted on G2.com.

The storyline is always a life-saver for SOC analyst. Helping map out child processes associated with a process has helped us uncover many issues.

Secondly, The automated mitigation makes ensures a threat does not execute within the oversight of the Analyst Review collected by and hosted on G2.com.

It is not easily to work with the queries. For example, inability to open some critical pages in a new tab or group related values makes it a bottleneck except for the use of purple AI, I really hate that for the tool . Review collected by and hosted on G2.com.

What I like best about SentinelOne Singularity Endpoint is its strong endpoint detection and response capabilities, automated threat response, and centralized visibility. It makes it easier to identify suspicious activity, investigate incidents, and respond quickly while reducing the amount of manual effort required from security teams Review collected by and hosted on G2.com.

The main drawback is that some advanced features can take time to learn and configure properly. The platform is feature-rich, so administrators may need additional training and tuning to get the best results for their specific environment. Review collected by and hosted on G2.com.

Most helpful for me would be its storyline feature. It threads together process trees, network requests, registry and file changes into one visual map. Review collected by and hosted on G2.com.

The SentinelOne query language used to threat hunt within Deep Visibility is a pain to use. It takes quite a toll to learn and use it efficiently and effectively. Else, you'll just keep getting 'No results found'. Review collected by and hosted on G2.com.