Logstash vs. Microsoft Sentinel

Overview
ProductRatingMost Used ByProduct SummaryStarting Price
Logstash
Score 8.0 out of 10
N/A
N/AN/A
Microsoft Sentinel
Score 8.2 out of 10
N/A
Microsoft Sentinel (formerly Azure Sentinel) is designed as a birds-eye view across the enterprise. It is presented as a security information and event management (SIEM) solution for proactive threat detection, investigation, and response.
$2.46
per GB ingested
Pricing
LogstashMicrosoft Sentinel
Editions & Modules
No answers on this topic
Azure Sentinel
$2.46
per GB ingested
100 GB per day
$123.00
per day
200 GB per day
$221.40
per day
300 GB per day
$319.80
per day
400 GB per day
$410.00
per day
500 GB per day
$492.00
per day
More than 500 GB per day
$492.00 + $98.40
per day/plus each additional 100 GB increment
Offerings
Pricing Offerings
LogstashMicrosoft Sentinel
Free Trial
NoYes
Free/Freemium Version
NoNo
Premium Consulting/Integration Services
NoNo
Entry-level Setup FeeNo setup feeNo setup fee
Additional Details
More Pricing Information
Features
LogstashMicrosoft Sentinel
Security Information and Event Management (SIEM)
Comparison of Security Information and Event Management (SIEM) features of Product A and Product B
Logstash
-
Ratings
Microsoft Sentinel
7.4
24 Ratings
5% below category average
Centralized event and log data collection00 Ratings8.124 Ratings
Correlation00 Ratings7.224 Ratings
Event and log normalization/management00 Ratings7.224 Ratings
Deployment flexibility00 Ratings7.222 Ratings
Integration with Identity and Access Management Tools00 Ratings7.022 Ratings
Custom dashboards and workspaces00 Ratings7.324 Ratings
Host and network-based intrusion detection00 Ratings6.220 Ratings
Data integration/API management00 Ratings7.022 Ratings
Behavioral analytics and baselining00 Ratings6.920 Ratings
Rules-based and algorithmic detection thresholds00 Ratings7.722 Ratings
Response orchestration and automation00 Ratings7.721 Ratings
Reporting and compliance management00 Ratings9.04 Ratings
Incident indexing/searching00 Ratings7.922 Ratings
Best Alternatives
LogstashMicrosoft Sentinel
Small Businesses
SolarWinds Papertrail
SolarWinds Papertrail
Score 8.9 out of 10
AlienVault USM
AlienVault USM
Score 7.2 out of 10
Medium-sized Companies
PRTG
PRTG
Score 8.9 out of 10
InsightIDR
InsightIDR
Score 9.2 out of 10
Enterprises
PRTG
PRTG
Score 8.9 out of 10
InsightIDR
InsightIDR
Score 9.2 out of 10
All AlternativesView all alternativesView all alternatives
User Ratings
LogstashMicrosoft Sentinel
Likelihood to Recommend
10.0
(3 ratings)
8.2
(43 ratings)
Likelihood to Renew
-
(0 ratings)
8.2
(1 ratings)
Usability
-
(0 ratings)
7.3
(4 ratings)
Support Rating
-
(0 ratings)
8.0
(3 ratings)
Professional Services
-
(0 ratings)
5.0
(1 ratings)
User Testimonials
LogstashMicrosoft Sentinel
Likelihood to Recommend
Elastic
Perfect for projects where Elasticsearch makes sense: if you decide to employ ES in a project, then you will almost inevitably use LogStash, and you should anyways. Such projects would include: 1. Data Science (reading, recording or measure web-based Analytics, Metrics) 2. Web Scraping (which was one of our earlier projects involving LogStash) 3. Syslog-ng Management: While I did point out that it can be a bit of an electric boo-ga-loo in finding an errant configuration item, it is still worth it to implement Syslog-ng management via LogStash: being able to fine-tune your log messages and then pipe them to other sources, depending on the data being read in, is incredibly powerful, and I would say is exemplar of what modern Computer Science looks like: Less Specialization in mathematics, and more specialization in storing and recording data (i.e. Less Engineering, and more Design).
Read full review
Microsoft
I'll go with where it's very suited in certain industries, including ours where the data resides or where it's being sent is incredibly important. So because the data stays within Microsoft World Garden, we are able to piggyback off of a lot of those certifications and meet certain requirements that allow us to expand where we sell our product to outside of scopes that we couldn't reach ourselves.
Read full review
Pros
Elastic
  • Logstash design is definitely perfect for the use case of ELK. Logstash has "drivers" using which it can inject from virtually any source. This takes the headache from source to implement those "drivers" to store data to ES.
  • Logstash is fast, very fast. As per my observance, you don't need more than 1 or 2 servers for even big size projects.
  • Data in different shape, size, and formats? No worries, Logstash can handle it. It lets you write simple rules to programmatically take decisions real-time on data.
  • You can change your data on the fly! This is the CORE power of Logstash. The concept is similar to Kafka streams, the difference being the source and destination are application and ES respectively.
Read full review
Microsoft
  • It is a good tool for threat detection and analysis of the threats. We are using this tool for real time threat detection on our employee machines as well as some servers.
  • It provides various options for collecting data sources by leveraging multiple sources using data connectors. This helps us in gathering data from multiple sources such as our servers as well as our employee machines.
  • One good thing about this tool is automated incident response thereby increasing the security of servers.
Read full review
Cons
Elastic
  • Since it's a Java product, JVM tuning must be done for handling high-load.
  • The persistent queue feature is nice, but I feel like most companies would want to use Kafka as a general storage location for persistent messages for all consumers to use. Using some pipeline of "Kafka input -> filter plugins -> Kafka output" seems like a good solution for data enrichment without needing to maintain a custom Kafka consumer to accomplish a similar feature.
  • I would like to see more documentation around creating a distributed Logstash cluster because I imagine for high ingestion use cases, that would be necessary.
Read full review
Microsoft
  • It takes some time to learn how to use and install it properly, and it does not connect effectively with external PaaS systems such as Salesforce CRM, Salesforce Commerce Cloud, and so on.
  • Microsoft can simplify the display of the logs to make them easier to study, and the user interface occasionally delays, which can also be enhanced.
Read full review
Usability
Elastic
No answers on this topic
Microsoft
The Microsoft Azure Sentinel solution is very good and even better if you use Azure. It's easy to implement and learn how to use the tool with an intuitive and simple interface. New updates are happening to always bring new news and improve the experience and usability. The solution brings reliability as it is from a very reliable manufacturer.
Read full review
Support Rating
Elastic
No answers on this topic
Microsoft
Azure Sentinel is very easy to use and configure. If you are stuck somewhere, Microsoft support is excellent in assisting and solving your issue.
Read full review
Alternatives Considered
Elastic
MongoDB and Azure SQL Database are just that: Databases, and they allow you to pipe data into a database, which means that alot of the log filtering becomes a simple exercise of querying information from a DBMS. However, LogStash was chosen for it's ease of integration into our choice of using ELK Elasticsearch is an obvious inclusion: Using Logstash with it's native DevOps stack its really rational
Read full review
Microsoft
I use most of the Sims that are out there, but RSAs, old Sim Log, logic, elastic, a lot of them. Sumo, we checked out Sumo too. We're a Microsoft shop and live almost entirely on top of a Microsoft ecosystem. We are considering other Microsoft security products to integrate with it. So it made a lot of sense to really drive as hard as we could Microsoft Sim at least for a few years to make sure it would fit us.
Read full review
Professional Services
Elastic
No answers on this topic
Microsoft
Did not use professional services
Read full review
Return on Investment
Elastic
  • Positive: Learning curve was relatively easy for our team. We were up and running within a sprint.
  • Positive: Managing Logstash has generally been easy. We configure it, and usually, don't have to worry about misbehavior.
  • Negative: Updating/Rehydrating Logstash servers have been little challenging. We sometimes even loose data while Logstash is down. It requires more in-depth research and experiments to figure the fine-grained details.
  • Negative: This is now one more application/skill/server to manage. Like any other servers, it requires proper grooming or else you will get in trouble. This is also a single point of failure which can have the ability to make other servers useless if it is not running.
Read full review
Microsoft
  • Log Management is a little difficult in-house as everything is situated on the cloud.
  • Paying according to the throughput of the data can be costlier for some organizations.
  • Excellent integration and log parsing for Microsoft products save many man-hours for the SIEM admin to focus on other things.
Read full review
ScreenShots

Microsoft Sentinel Screenshots

Screenshot of Screenshot of Screenshot of Microsoft Sentinel Capabilities