G2

Abhishek N.

SOC L1 Engineer

Mid-Market (51-1000 emp.)

11/2/2026

"Real-Time Behavioral AI and One-Click Rollback That Save Hours"

4.5/5

What do you like best about SentinelOne Singularity Endpoint?

What I like best about SentinelOne Singularity Endpoint is its agent-level behavioral AI that blocks real-time threats like ransomware or malicious scripts even when machines are offline. It gives us instant local protection without waiting on cloud analysis. The standout feature for L1 workflow is the automated rollback capability. If a threat modifies or encrypts local files, we can restore them to their original state in a single click using VSS shadow copies, saving us from time-consuming endpoint re-imaging. Review collected by and hosted on G2.com.

What do you dislike about SentinelOne Singularity Endpoint?

What I dislike most about SentinelOne Singularity Endpoint is the occasional complexity when dealing with false positives or aggressive behavioral detections. Sometimes legitimate internal scripts or administrative tools get flagged, and writing exclusions requires file path or hash tuning to prevent recurring alerts without weakening security. Additionally, while the storyline is great for endpoints, when we need to correlate those endpoint alerts with wider network or email telemetry, SentinelOne's native multi-layer visibility is limited. We end up having to jump over to other tools like FortiSIEM, Splunk, or CrowdStrike NG SIEM to piece together a broader multi-vector attack chain. Review collected by and hosted on G2.com.

What problems is SentinelOne Singularity Endpoint solving and how is that benefiting you?

SentinelOne Singularity Endpoints solve several critical operational challenges, starting with the risk of destruction from ransomware. Traditional security tools can stop a malicious process, but they leave damaged files behind. SentinelOne solves this through its automated rollback feature using VSS shadow copies, allowing us to restore encrypted or modified files to their original state with a single click instead of escalating machines for time-consuming re-imaging. It also eliminates the heavy operational burden of manual log correlation during incident triage. Instead of forcing analysts to write complex search queries across SIEMs like Splunk or FortiSIEM, SentinelOne uses storyline IDs to automatically map out parent-child processes, registry modifications, and network connections into a single execution tree. This automated context saves our L1 team 15 to 20 minutes per incident when identifying the root cause. Review collected by and hosted on G2.com.