In short: SentinelOne Singularity AI SIEM brings SentinelOne telemetry and logs from third-party tools such as firewalls, email and identity providers into one platform with fast hot storage for search, detection and investigation. Data ingest is licensed per gigabyte, with retention options of 14, 30, 90, 180 or 365 days.
What Singularity AI SIEM is
A SIEM (security information and event management) collects logs from across your environment so you can search them, detect threats that span several systems and keep records for investigations and compliance. Singularity AI SIEM is SentinelOne's take on this, built on the same data platform as its endpoint, cloud and identity products.
Telemetry from SentinelOne agents arrives automatically. Logs from third-party tools (firewalls, email security, identity providers, cloud platforms and SaaS applications) come in through a single ingestion pipeline. SentinelOne emphasises hot storage, meaning older data stays quickly searchable rather than being pushed into a slow archive.
Investigation is handled by Purple AI, and containment and remediation can be triggered natively or through Hyperautomation. Singularity Data Pipelines (formerly Observo) normalise, enrich and route data on the way in, so noisy sources can be cleaned up before they are stored.
Data ingest and retention options
| Option | Retention | Licensed by |
|---|---|---|
| Data ingest, 14 day retention | 14 days | Gigabyte ingested |
| Data ingest, 30 day retention | 30 days | Gigabyte ingested |
| Data ingest, 90 day retention | 90 days | Gigabyte ingested |
| Data ingest, 180 day retention | 180 days | Gigabyte ingested |
| Data ingest, 365 day retention | 365 days | Gigabyte ingested |
Retention for SentinelOne's own endpoint telemetry is handled separately through Deep Visibility retention add-ons on Singularity Endpoint, licensed per endpoint.
How AI SIEM is licensed
Third-party data ingest is licensed per gigabyte, and the price depends on how long the data is kept. That makes two decisions important before you buy: which sources you really need (verbose debug logs add volume without adding much security value) and how long you must keep them, which is often driven by insurer, contract or regulatory requirements.
We can supply ingest month to month or on an annual commitment billed monthly. We help you estimate daily volumes from each source before quoting, then review actual usage after the first month. Ask us for a quote.
Requirements and deployment
We work through your log sources with you, connect them using SentinelOne's integrations or standard syslog and API collection, and check data is parsing correctly. We then build or enable detections for the threats that matter to you, such as impossible-travel sign-ins, firewall configuration changes or mass mailbox rule creation, and set up dashboards and reports for the people who need them.
Who it suits
- organisations already using SentinelOne that want firewall, email and identity logs in the same place
- businesses replacing an expensive or under-used legacy SIEM
- teams that need searchable log history for investigations, audits or cyber insurance
If you mainly need 24/7 monitoring rather than a SIEM of your own, Vigilance MDR may be the better first step.
How we help
- Inventory your log sources: firewalls, email security, identity providers, cloud platforms and SaaS apps, with a rough daily volume for each.
- Size ingest and retention: we match retention to the period your insurer, contracts or regulators actually require, rather than defaulting to the longest.
- Connect and verify: we bring each source in, check it parses correctly and turn on the detections that matter to you.
- Review real usage: after the first month we compare actual ingest with the estimate and adjust your licence.
Compare other approaches in EDR, XDR and MDR.
How Forever Systems supplies your software licences
Forever Systems Ltd supplies business software subscriptions to UK organisations from one account, with one monthly invoice and a UK team who know the products.
- The right edition first time: we check what you need before you buy, so you are not paying for features you will never use
- Monthly or annual terms where the vendor offers them, and help timing renewals and commitments
- Licence changes handled for you: add or remove users, upgrade editions and true-up without starting a new contract
- Deployment and support from engineers who run these products every day, not just a reseller account
- Consolidated billing and renewal reminders so nothing lapses unexpectedly
We work with businesses, schools, charities and public sector organisations of all sizes.
Need a licence quote or a second opinion on your renewal?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
How is SentinelOne AI SIEM priced?
Third-party data ingest is licensed per gigabyte, with the rate depending on the retention period you choose: 14, 30, 90, 180 or 365 days. Ask us for a quote based on your log volumes.
Is Singularity AI SIEM the same as Singularity Data Lake?
Not quite. SentinelOne still uses the Singularity Data Lake name for the shared data store its products write to, and AI SIEM is the SIEM product that works over that shared foundation, with Singularity Data Pipelines handling ingestion. Today SentinelOne markets the SIEM capability as Singularity AI SIEM.
Can AI SIEM ingest firewall and Microsoft 365 logs?
Yes. AI SIEM is designed to take telemetry from third-party tools as well as SentinelOne's own agents. We check the integration for each of your sources before quoting.
How do I keep SIEM costs under control?
Ingest only the sources that add security value, filter noisy logs before storage with the data pipeline and match retention to your real requirement. We review usage after the first month.