Alert Logic delivers managed detection and response (MDR) with comprehensive coverage for public clouds, SaaS, on-premises, and hybrid environments. Alert Logic is a LevelBlue solution since the January 2026 acquisition.
N/A
Microsoft Sentinel
Score 8.7 out of 10
N/A
Microsoft Sentinel (formerly Azure Sentinel) is designed as a birds-eye view across the enterprise. It is presented as a security information and event management (SIEM) solution for proactive threat detection, investigation, and response.
This is pretty good AV product - lightweight, easy to install, and easy on system resources. It will take some getting used to on the end user side, it doesn't scan in a traditional way, and it does not have a taskbar icon so it hard to know if it's working or installed. My only complaint would be the false positives which I know every AV system has, but the problem with Barkly is that it alerts the users with a message (which they freak out about) and it alerts IT with an email. Again, not a major issue, but it can be annoying until it is overridden. The override process is super easy though, so its again, not a big deal.
Specifically for Microsoft Sentinel, it's going to have what's next to no value if you're not on Azure. You have to be in as your customer. If you want greater insight into what is going on in your cloud environment, turn Microsoft Sentinel on, but focus on where you enable it. You're not going to turn it on to see everything because it's not like focus on the areas where you are at risk or you believe you're at risk or something that you're, depending on your environment, do you have multiple subscriptions? Do you have a Microsoft Sentinel subscription that you just turned on, but it's not getting the visibility, and then you can alert on stuff that goes out of trend, etc.?
Customer Service. Usually, I'd put the technical details up front, and they're good with that too. But the service from pre-sales all the way through onboarding and continued account management is top tier. Our onboarding schedule got messed up, partly because of us, but that was rather minor. I always get prompt replies to any tickets, and they've even reached out to discuss my feature requests. When it comes to security, it's critical to have a responsive team, and they've got it.
Detection seems good. It's hard to quantify exactly, but it seems that they always detect the bad actors. And when we get an alert, they include a bunch of details so we know what kind of scan they're trying to do, how far they got, etc. You can't prevent everyone from doing a scan on your IP, but it gives you a really good idea of where your soft spots might be. And if you're getting those low-level alerts, it's a reminder that it's there and working if you have a major event too.
Very easy setup. This goes back to their customer support to some extent, as they walk you through all the steps required. But it's also about their technical solution, it's not so overly complex that it's fragile, nor does it take a great deal of time to deploy. And it's been zero effort to maintain since then.
Strong integration with the Microsoft security ecosystem allows seamless connection to services such as Microsoft Defender, Microsoft 365, and Azure. This makes it easy to bring together identity, endpoint, and cloud signals to support investigation and detection scenarios.
Effective correlation of alerts and incidents in collaboration with Microsoft Defender XDR helps combine related signals into higher‑fidelity incidents. This reduces noise and improves visibility into attack context, making investigations more efficient.
High scalability for data ingestion and processing enables large volumes of security telemetry to be handled efficiently.
I think it's primarily going to be cost, since Microsoft Sentinel uses Microsoft Log Analytics as its base, right? So storing the logs and log retention is very expensive. That might result in users not adopting it as quickly. Second, I think Copilot for security can just do summarization and not many remediation tasks. In the future, we would like to see Copilot create many playbooks, including all box playbooks, to remediate many security issues.
The Microsoft Azure Sentinel solution is very good and even better if you use Azure. It's easy to implement and learn how to use the tool with an intuitive and simple interface. New updates are happening to always bring new news and improve the experience and usability. The solution brings reliability as it is from a very reliable manufacturer.
I was using Alert Logic Insight for myself to improve my skills and ability to it. My organization was not happy using our previous website security program so I recommended for them to use this software. It has been more than 1 year and still, they are using this program without having any problem so far.
Microsoft Sentinel excels in cloud-native scalability, Microsoft ecosystem integration, and AI-driven threat detection with UEBA and Fusion rules, offering faster deployment and lower costs (48% cheaper per Forrester) than Splunk, QRadar, Exabeam, SentinelOne, Securonix, and Wazuh. It lags in third-party integrations and syslog parsing. Organizations choose Microsoft Sentinel for its cost-effectiveness, automation, and Microsoft synergy, especially in Azure-heavy environments, though Splunk and Exabeam lead in flexibility and UEBA, respectively.
As any cybersecurity product, this has to be more with risk to avoid loss in case of a ransomware that more than relate to a productivity increase. Maybe the impact could be that instead of having people that are checking 24/7 the dashboard, you could implement Sentinel and have less people checking that or people with less expertise. So the saving will be a minor but will be a saving in the cost of your team.
