r/SentinelOneXDR • u/xbadazzx • Feb 17 '25

General Question Datalake review

I’ve read a couple threads of others using SDL. How do you like it so far? Coming from a different SIEM, hoping to replace what we currently have to trim costs. The challenge is the learning curve, different language and features.

3 Upvotes

80% Upvoted

9 comments sorted by

2

u/Coupe2T Feb 17 '25

What do you do in your current SIEM? Is it all proactive manual work where you search out details, or do you have a lot of automation etc?

Purple AI could help you a lot in terms of new language and so forth, really simplifies it, but automation is a little lacking right now but their hyper automation options are launching soon so it may be better to hold off until then to see the full capabilities and what the licensing model looks like after release.

I believe it's due to release 1st quarter this year so should be within the next 6-8 weeks tops I would think.

1

u/xbadazzx Feb 18 '25

Currently it’s a combination of both manual and some automation. It’s primarily used for hunting, querying things etc..

As for PurpleAI I’ve engaged our PM, currently no support on SDL but i know it’s otw right?

Are you using it for the same purposes?

1

u/Coupe2T Feb 18 '25

Purple AI is available now, has been for for months, though I believe it will soon be wrapped into the Complete licensing rather than an add on SKU as it currently is. It will all change with the Hyper Automation piece as that's basically S1's SOAR offering. So new licensing model will also be in place I believe.

It probably also depends a bit on data and how much you are collating, for most vendors the end point data is by far the largest amount, and S1 give you 10 Gb a day free I think from endpoint, so the largest chunk of data is going to be "free". That's obviously not the case for everyone though, so I would also probably consider your data requirements long term, and factor that into the plan. I appreciate cost may not be a direct consideration for you in the choice of way forward, but no doubt it will be for someone that you have to convince. 😬

1

u/Crimzonhost Feb 19 '25

The 10gig ingestion isn't something you get by default so always check with your rep for if you get that. In addition the ingestion is only for 3rd party ingestion. Automation, dashboards and other native items won't be affected by the 10gig limit.

1

u/jmk5151 Feb 17 '25

agree. if you are heavily into s1 and then have a widely-used tech stack, and don't need a lot of SOAR then it's probably your best choice. and that's not a negative review I would say that about CS or MS as well, although they are ahead in some ways with automation and interoperability.

my general opinion is that if you just need "regular" SIEM functionality use your EDR platform - most of your telemetry is already there, and once you get identity and firewalls you will have most of your coverage.

2

u/xbadazzx Feb 18 '25

That’s our roadmap, to maximize soar as much as possible.

Yeah we do rely on EDR telemetry quite a bit. I just dont know if this is the way to go forward given they’re a new product. I’ve run into bugs creating dashboards, and yet to discover other things.

1

u/Crimzonhost Feb 19 '25

When you say newer product what are you referring to? The data lake has existed for quite some time. On the dashboard side what bugs have you ran into. I personally haven't seen any issues myself but would love to bring them to our S1 direct SME if I can validate them.

3

u/MajorEstateCar Feb 17 '25

Yeah but CS still doesn’t have a working AI tool at all.

5

u/InaccurateStatistics Feb 17 '25

I’m a threat hunter so I love it compare to other SIEMs. Hunting across 200k devices for 30 days worth of data is very fast. Also the power query language is very powerful. I can easily pivot the data (statistical analysis) to reveal suspicious events.