Endpoint Detection & Response (EDR)

Microsoft Defender for Endpoint vs SentinelOne Singularity

Compare Microsoft Defender for Endpoint and SentinelOne Singularity side-by-side. See feature differences and pricing in the Endpoint Detection & Response (EDR) category.

Microsoft Defender for Endpoint

by Microsoft

No reviews yet

Pricing: Defender for Business $3 per user a month, billed yearly; Plan 1 and Plan 2 on request or in Microsoft 365 E3 and E5; Defender Suite $12 per user a month, billed yearly

Microsoft Defender for Endpoint is endpoint protection and EDR software for Windows, macOS, Linux, iOS and Android, sold alone or inside Microsoft 365 suites.

17 /18 features Full profile

SentinelOne Singularity

by SentinelOne

No reviews yet

Pricing: Singularity Complete $179.99 and Commercial $229.99 per endpoint a year, for 5 to 100 workstations through a partner; Enterprise by quote.

SentinelOne Singularity is endpoint protection and EDR software for security teams and MSSPs, with an on-device AI agent that keeps working offline.

15 /18 features Full profile

Feature Comparison

Endpoint Detection & Response (EDR) features side-by-side

Feature	Microsoft Defender for Endpoint 17/18 features	SentinelOne Singularity 15/18 features
Continuous endpoint telemetry recording Process, file, registry, network and login events are recorded continuously, not only when an alert fires.	Yes	Yes
Process tree view of each alert Every detection shows the parent-child process chain and the actions each process took.	Yes	Yes
One-click host network isolation An analyst can cut a device off the network from the console while keeping the agent connection.	Yes	Yes
Live response shell Run commands, pull files and kill processes on a live endpoint from the management console.	Yes	Yes
Custom detection rules on endpoint telemetry Analysts write their own detection logic against recorded telemetry and get alerts from it.	Yes	No
Query-based threat hunting across endpoints Raw telemetry from every endpoint can be searched with a query language, not only per host.	Yes	Yes
Alerts grouped into incidents Related alerts on the same host or from the same attacker are merged into one incident record.	Yes	Yes
ATT&CK technique tags on detections Each detection is labelled with the MITRE ATT&CK tactic and technique it matched.	Yes	Yes
Automated investigation and remediation Alerts are triaged automatically and malicious files or persistence are reverted without an analyst.	Yes	Yes
Custom IOC block and allow lists Hashes, IPs and domains can be added as indicators that the agent blocks or allows.	Yes	No
Command-line and script content capture Full command lines and PowerShell script blocks are recorded for later investigation.	No	No
Detection exclusions and suppression rules A known-benign detection can be suppressed by host, path or process to stop repeat alerts.	Yes	Yes
Telemetry retention of 30 days or more Searchable raw endpoint telemetry is kept for at least 30 days on the standard plan.	Yes	Yes
Telemetry streaming to a SIEM Raw events or alerts can be forwarded to a SIEM or data lake through a supported connector.	Yes	Yes
Forensic package collection from a host Memory, logs and artefacts can be gathered from a host into a package for offline analysis.	Yes	Yes
Server and cloud workload sensor The same sensor covers Windows and Linux servers and cloud virtual machines, not only laptops.	Yes	Yes
Vendor-run threat hunting add-on The vendor's own analysts hunt across the customer's telemetry as a paid option.	Yes	Yes
MITRE ATT&CK Evaluations participant The product has published results in a public MITRE Engenuity ATT&CK Evaluation round.	Yes	Yes
Overall Rating	No reviews yet	No reviews yet

Microsoft Defender for Endpoint 17/18 features

Continuous endpoint telemetry recording: Yes
Process tree view of each alert: Yes
One-click host network isolation: Yes
Live response shell: Yes
Custom detection rules on endpoint telemetry: Yes
Query-based threat hunting across endpoints: Yes
Alerts grouped into incidents: Yes
ATT&CK technique tags on detections: Yes
Automated investigation and remediation: Yes
Custom IOC block and allow lists: Yes
Command-line and script content capture: No
Detection exclusions and suppression rules: Yes
Telemetry retention of 30 days or more: Yes
Telemetry streaming to a SIEM: Yes
Forensic package collection from a host: Yes
Server and cloud workload sensor: Yes
Vendor-run threat hunting add-on: Yes
MITRE ATT&CK Evaluations participant: Yes

No reviews yet

SentinelOne Singularity 15/18 features

Continuous endpoint telemetry recording: Yes
Process tree view of each alert: Yes
One-click host network isolation: Yes
Live response shell: Yes
Custom detection rules on endpoint telemetry: No
Query-based threat hunting across endpoints: Yes
Alerts grouped into incidents: Yes
ATT&CK technique tags on detections: Yes
Automated investigation and remediation: Yes
Custom IOC block and allow lists: No
Command-line and script content capture: No
Detection exclusions and suppression rules: Yes
Telemetry retention of 30 days or more: Yes
Telemetry streaming to a SIEM: Yes
Forensic package collection from a host: Yes
Server and cloud workload sensor: Yes
Vendor-run threat hunting add-on: Yes
MITRE ATT&CK Evaluations participant: Yes

No reviews yet

Pricing

Microsoft Defender for Endpoint

Defender for Business $3 per user a month, billed yearly; Plan 1 and Plan 2 on request or in Microsoft 365 E3 and E5; Defender Suite $12 per user a month, billed yearly

See all plans

SentinelOne Singularity

Singularity Complete $179.99 and Commercial $229.99 per endpoint a year, for 5 to 100 workstations through a partner; Enterprise by quote.

See all plans

Explore Each Product

Microsoft Defender for Endpoint Read reviews, features & pricing

SentinelOne Singularity Read reviews, features & pricing

Looking for more options?

Browse all Endpoint Detection & Response (EDR)