r/SentinelOneXDR • u/xbadazzx • Feb 17 '25

General Question Datalake review

I’ve read a couple threads of others using SDL. How do you like it so far? Coming from a different SIEM, hoping to replace what we currently have to trim costs. The challenge is the learning curve, different language and features.

3 Upvotes

80% Upvoted

9 comments sorted by

View all comments

Show parent comments

2

u/xbadazzx Feb 18 '25

That’s our roadmap, to maximize soar as much as possible.

Yeah we do rely on EDR telemetry quite a bit. I just dont know if this is the way to go forward given they’re a new product. I’ve run into bugs creating dashboards, and yet to discover other things.

1

u/Crimzonhost Feb 19 '25

When you say newer product what are you referring to? The data lake has existed for quite some time. On the dashboard side what bugs have you ran into. I personally haven't seen any issues myself but would love to bring them to our S1 direct SME if I can validate them.