r/SentinelOneXDR

Hello everyone,

Everything is in the title, how SDL is so slow, usual query or powerquery it is always so slow. Only data from the S1 agent is within our SDL.

People will say that I should not do heavy queries or this kind of thing, but let's be honest. I also use an opensearch for other technologies, especially our proxy where there is way more volume than S1. And my opensearch is not so slow when I do a query.

Even more painful, if I do request by API, I have to pray that no one is doing a request in the UI, otherwise the API call will be so long.

Are we the only one ?