Elastic Security vs. Microsoft Sentinel

Overview
ProductRatingMost Used ByProduct SummaryStarting Price
Elastic Security
Score 8.8 out of 10
N/A
Elastic Security equips analysts to prevent, detect, and respond to threats. The free and open solution delivers SIEM, endpoint security, threat hunting, and cloud monitoring. The solution encompasses Elastic SIEM, which brings Elasticsearch to SIEM and threat hunting. The Elastic Agent (or Elastic Endpoint Security based on the former Endgame security product acquired by Elastic in late 2019) brings signatureless malware prevention to endpoints, as well as security data collection for…N/A
Microsoft Sentinel
Score 8.4 out of 10
N/A
Microsoft Sentinel (formerly Azure Sentinel) is designed as a birds-eye view across the enterprise. It is presented as a security information and event management (SIEM) solution for proactive threat detection, investigation, and response.
$2.46
per GB ingested
Pricing
Elastic SecurityMicrosoft Sentinel
Editions & Modules
No answers on this topic
Azure Sentinel
$2.46
per GB ingested
100 GB per day
$123.00
per day
200 GB per day
$221.40
per day
300 GB per day
$319.80
per day
400 GB per day
$410.00
per day
500 GB per day
$492.00
per day
More than 500 GB per day
$492.00 + $98.40
per day/plus each additional 100 GB increment
Offerings
Pricing Offerings
Elastic SecurityMicrosoft Sentinel
Free Trial
NoYes
Free/Freemium Version
NoNo
Premium Consulting/Integration Services
NoNo
Entry-level Setup FeeNo setup feeNo setup fee
Additional Details
More Pricing Information
Community Pulse
Elastic SecurityMicrosoft Sentinel
Top Pros
Top Cons
Features
Elastic SecurityMicrosoft Sentinel
Security Information and Event Management (SIEM)
Comparison of Security Information and Event Management (SIEM) features of Product A and Product B
Elastic Security
-
Ratings
Microsoft Sentinel
8.4
14 Ratings
7% above category average
Centralized event and log data collection00 Ratings8.614 Ratings
Correlation00 Ratings8.414 Ratings
Event and log normalization/management00 Ratings8.214 Ratings
Deployment flexibility00 Ratings9.213 Ratings
Integration with Identity and Access Management Tools00 Ratings8.513 Ratings
Custom dashboards and workspaces00 Ratings7.414 Ratings
Host and network-based intrusion detection00 Ratings7.613 Ratings
Data integration/API management00 Ratings8.214 Ratings
Behavioral analytics and baselining00 Ratings8.712 Ratings
Rules-based and algorithmic detection thresholds00 Ratings8.513 Ratings
Response orchestration and automation00 Ratings8.414 Ratings
Reporting and compliance management00 Ratings9.04 Ratings
Incident indexing/searching00 Ratings8.614 Ratings
Best Alternatives
Elastic SecurityMicrosoft Sentinel
Small Businesses
AlienVault USM
AlienVault USM
Score 8.0 out of 10
AlienVault USM
AlienVault USM
Score 8.0 out of 10
Medium-sized Companies
Splunk Enterprise
Splunk Enterprise
Score 8.4 out of 10
Splunk Enterprise
Splunk Enterprise
Score 8.4 out of 10
Enterprises
Microsoft Sentinel
Microsoft Sentinel
Score 8.4 out of 10
Splunk Enterprise
Splunk Enterprise
Score 8.4 out of 10
All AlternativesView all alternativesView all alternatives
User Ratings
Elastic SecurityMicrosoft Sentinel
Likelihood to Recommend
9.0
(1 ratings)
8.6
(21 ratings)
Usability
-
(0 ratings)
7.3
(4 ratings)
Support Rating
7.0
(1 ratings)
8.0
(3 ratings)
Professional Services
-
(0 ratings)
5.0
(1 ratings)
User Testimonials
Elastic SecurityMicrosoft Sentinel
Likelihood to Recommend
Elastic
I believe Endgame is well suited to organizations that have their own Cybersecurity department. Its not well suited for organizations that don't have a Cybersecurity department.
Read full review
Microsoft
Sentinel is the best "cloud-native" in the market yet, so if the organization has a cloud presence (which almost everyone has) then Sentinel is the right choice for having a single pane of glass for all your security monitoring needs. Sentinel is a very good tool for log analysis and event management purposes as well. With KQL and ASIM parsers, organizations can retrieve invaluable insights even from the most complex data. And of course, Sentinel is a great choice for automating the incident response process to a very good extent.
Read full review
Pros
Elastic
  • Identify 0-day malware.
  • Provides a few forensic details on endpoints.
  • Very easy to administer.
Read full review
Microsoft
  • It has a native integration with all Microsoft products, from Entra to Azure, Microsoft 365
  • Being built upon native Azure functionality benefits in automation and infrastructual solutions
  • The KQL language is relatively easy to learn and powerful.
  • Microsoft is listening very careful to the customers and develops new functionality at a fast pace
Read full review
Cons
Elastic
  • I would love that it provided more memory analysis details.
  • Being able to edit sensor profiles after creating them.
  • I would love it if it provided more automation features.
Read full review
Microsoft
  • It takes some time to learn how to use and install it properly, and it does not connect effectively with external PaaS systems such as Salesforce CRM, Salesforce Commerce Cloud, and so on.
  • Microsoft can simplify the display of the logs to make them easier to study, and the user interface occasionally delays, which can also be enhanced.
Read full review
Usability
Elastic
No answers on this topic
Microsoft
The Microsoft Azure Sentinel solution is very good and even better if you use Azure. It's easy to implement and learn how to use the tool with an intuitive and simple interface. New updates are happening to always bring new news and improve the experience and usability. The solution brings reliability as it is from a very reliable manufacturer.
Read full review
Support Rating
Elastic
Even though their support is good, I think there are some areas where they need to provide more thorough solutions to issues, some of their solutions are pretty basic and have already been tried.
Read full review
Microsoft
Azure Sentinel is very easy to use and configure. If you are stuck somewhere, Microsoft support is excellent in assisting and solving your issue.
Read full review
Alternatives Considered
Elastic
Endgame is based on the MITRE framework which has proven to be a successful framework to identify various attack patterns that attackers use. Also, compared to the others it's easier to administer and manage.
Read full review
Microsoft
The key advantage of using Sentinel lies in Microsoft already being a renowned name in cloud services. Hence, the Collection of data at the cloud scale across all users, devices, applications, and infrastructure, both on-premises and especially in the MS Cloud, is super easy. Additionally, leveraging Threat Intel from Microsoft itself gives a sense of security, given their years of experience in the collection of intel. The AI and Machine learning features provided by MS is one of the finest.
Read full review
Professional Services
Elastic
No answers on this topic
Microsoft
Did not use professional services
Read full review
Return on Investment
Elastic
  • Being able to identify threats we couldn't identify before.
  • Easier management of endpoints.
  • Being able to immediately isolate endpoints remotely that have high severity threats.
Read full review
Microsoft
  • Microsoft Sentinel is a good investment, especially when sided with other solutions such as Microsoft 365 Defender, as it provides 360° protection on every level of the infrastructure.
  • When deployed on infrastructures that have never had an SIEM, Microsoft Sentinel helps to assess vulnerabilities and misconfigurations.
  • As with any other SIEM, Microsoft Sentinel basically eliminates the need to put effort into every single platform (like EDR, NDR, XDR) and converge that effort on a single product that correlates and orchestrates the rest.
Read full review
ScreenShots

Microsoft Sentinel Screenshots

Screenshot of Screenshot of Screenshot of Microsoft Sentinel Capabilities