Mandiant Advantage Automated Defense vs. Microsoft Sentinel

I am having a very good experience with the Mandiant Advantage Automated Defense product where I can monitor the network with great ease and be regularly updated throughout the day without using some heavy tools and running queries. It is indeed a very good and easy-to-use tool that helps us monitor with great ease.

Incentivized

I think that the pro is well suited for a complex environment for a big organization that has people that has a mid-size cybersecurity team in place. And it's less appropriate if you are a not so big company because the budget could be important. Barrier to adopt it right on the right way

Incentivized

• I appreciate that it keeps the data within our, what we call our, authorization boundary. The fact that the data remains within Microsoft's, I guess, walled garden if you will, is very helpful for certain compliance needs in particular.
• The large library of ingestion: ability to ingest is basically as easy as I can basically get it to be most of the time. There's occasionally some vendors that it's a little bit more challenging for, but given the ease of integration for a lot of things, basically it's become one of my requirements when I am looking at other tools is how easily do they integrate with Sentinel.

Incentivized

• A more detailed view about the incidents and what they were highlighted
• A false positive might take up to a week to get corrected at the backend and not be shown as an incident
• Switching between clients and their dashboards can be made more efficient

Incentivized

• I think it should include more third party integration with non microsoft products as well as with other cloud providers. These integrations should be native.
• It should improve ML and AI capabilities.
• I find its documentation a little bit difficult to understand at the start. So the words should be simple.

Incentivized

Because I use it on a daily basis and it is a friendly tool.

Incentivized

The Microsoft Azure Sentinel solution is very good and even better if you use Azure. It's easy to implement and learn how to use the tool with an intuitive and simple interface. New updates are happening to always bring new news and improve the experience and usability. The solution brings reliability as it is from a very reliable manufacturer.

Incentivized

Azure Sentinel is very easy to use and configure. If you are stuck somewhere, Microsoft support is excellent in assisting and solving your issue.

Incentivized

I was quite satisfied with the implementation.

Incentivized

Well before there was Microsoft Sentinel, you had other competing products like ArcSight or Splunk, et cetera. I think they have their own qualities, but the Microsoft integration story is really why we're using it.

Incentivized

Did not use professional services

Incentivized

• Reduced security engineering costs
• Reduced IT/SOC overhead costs
• Less time wasted pursuing false positives

Incentivized

• Log Management is a little difficult in-house as everything is situated on the cloud.
• Paying according to the throughput of the data can be costlier for some organizations.
• Excellent integration and log parsing for Microsoft products save many man-hours for the SIEM admin to focus on other things.

Incentivized