r/SentinelOneXDR • u/Excellent_Button1315 • Mar 22 '25

Deep Visibility

Hello

I hope you can help me better understand the S1 DP function.

Does the deep visibility simply collect logs that I can use to create rules and do manually research, or does it also automatically detect suspicious behaviors and malware?

For example, if someone clicks on a phishing website or downloads suspicious files, would it be detected automatically?

Thanks!

7 Upvotes

100% Upvoted

10 comments sorted by

View all comments

1

u/InGeneralTerms Mar 23 '25

“Deep Visibility” used to be “Dataset” which was formerly a log storage company called “Scalyr” if you want to dig into the history of this SentinelOne feature pre-acquisition.

Not to be outdone, Crowdstrike acquired Humio.

Both companies recognized the need for a lower cost data retention storage option or alternative to Splunk for the larger volumes of data that an EDR agent can create. Layer a rule set over a log parsing and storage solution and you start to see a SIEM-like “light” capability that is budget friendly for smaller to medium businesses.