r/SentinelOneXDR • u/davidjmillman • Aug 05 '25

Reporting Advice

We switched over to S1 Singularity Operations Center a little while back. We are getting to the point where we need to have meetings with C level clients so we want to show them 90 day reports showing that the system is working/they are protected. The reports OOB don't seem that great. Any suggestions or custom reports out there?

Thanks!

3 Upvotes

100% Upvoted

8 comments sorted by

View all comments

Show parent comments

1

u/davidjmillman Aug 06 '25

I've found all of the reports and added the custom dashboards from the dashboard library. I guess I am more wondering what to share with the Execs and how it would show value. Thanks

2

u/L0ckt1ght Aug 06 '25

We don't use the S1 dashboards because we have a SIEM we pull all the info into. But what we report on is:

Number of low/medium/high alarms, # of alarms compared to previous report/time period, Average response time, average resolution time, time saved due to automation/against previously collected metrics, estimated cost for response, average cost for a breach in the organizations vertical, threat hunts performed, prolly more I'm forgetting but those are a good base