SentinelOne comes with five pricing packages: Singularity Core, Singularity Control, Singularity Complete, Singularity Commercial and Singularity Enterprise. I will focus on Singularity complete and add-ons that can be used with Singularity Complete, including core platform features, paid add-ons, managed services, and integrations.
1. Core Platform: Singularity Complete (Includes Purple AI)
Singularity Complete is SentinelOne’s AI-powered endpoint and cloud workload protection platform. It provides:
- Unified agent and console for endpoint and cloud telemetry
- Real-time, autonomous prevention, detection, and response (EPP + EDR + CWPP)
- Embedded Purple AI for natural language threat hunting and investigation
- 14-day standard data retention (upgradeable)
- Support for Windows, macOS, Linux, and cloud workloads (AWS, GCP, Azure, private cloud)
- Storyline technology for visual event correlation
- 1-click rollback and automated remediation
- Role-based access control and multi-tenant management
2. Included Features (No Additional Licence Required)
- EDR & EPP: Full endpoint protection, detection, and response
- Cloud Workload Protection: Real-time protection for servers, VMs, containers
- Firewall & Device Control: Advanced controls for endpoint security
- Remote Shell: Secure remote access for investigation and response
- STAR Custom Rules: Up to 100 concurrent custom detection rules
- Rogues/IoT Discovery: Visibility into unmanaged and IoT devices
- Application & Device Inventory
- Basic Application Vulnerability Management: Application inventory and basic vulnerability detection
3. Paid Add-ons and Modules
|
Add-on/module |
Description / Benefit |
Notes / Licensing |
|
Purple AI SOC Analyst |
Advanced generative AI for threat hunting, investigation, and response |
Now included in new Complete SKUs; advanced tier available as add-on |
|
Cloud Funnel |
Stream enriched EDR/XDR data to customer-owned cloud storage (S3, GCS, Azure Blob) |
For SIEM/SOAR integration, long-term retention |
|
RemoteOps Forensics |
Scalable digital forensics and incident response (DFIR) |
Requires add-on licence |
|
Singularity Mobile |
Mobile device protection (iOS, Android, ChromeOS) |
Requires separate Mobile Agent add-on |
|
Data Retention Upgrades |
Extend EDR data retention from 14 days to 365 days |
Paid upgrade |
|
Storyline Active Response (STAR Pro) |
Increase custom detection rules (from 100 to 400/1000) and automate response workflows |
Add-on licence required |
|
Binary Vault |
Forensics file upload and analysis |
Included for malicious files; benign file support as add-on |
|
Singularity Threat Intelligence |
Mandiant-powered threat intelligence integration |
Add-on licence required |
|
Singularity Vulnerability Management |
Advanced vulnerability management (OS-level, network discovery, dynamic risk scoring) |
Formerly Ranger Insights; add-on licence required |
|
Singularity Network Discovery |
Full network asset discovery and attack surface management |
Add-on licence required |
|
Singularity Identity Detection & Response (ITDR) |
Identity threat detection and response across endpoints and domain controllers |
Add-on licence required |
|
Singularity Identity for IDPs |
Identity security for identity providers |
Add-on licence required |
|
Identity Security Posture Management (ISPM) |
Identity security posture management |
Add-on licence required |
|
Singularity Cloud Data Security (CDS) |
Threat detection for cloud storage (Amazon S3, NetApp, Azure, GCP) |
Add-on licence required |
|
Singularity Hyperautomation |
Automated security workflows and playbooks |
Add-on licence required |
|
Open Data Ingestion |
Ingest security and IT data from external sources for deeper visibility |
Add-on licence required |
For more information on Singularity Packages, check SentinelOne site.
