Microsoft Sentinel (formerly Azure Sentinel) is designed as a birds-eye view across the enterprise. It is presented as a security information and event management (SIEM) solution for proactive threat detection, investigation, and response.
$2.46
per GB ingested
SolarWinds Papertrail
Score 8.9 out of 10
N/A
Austin based SolarWinds acquired log management tool Papertrail in April, 2015.
Microsoft Sentinel excels in centralized monitoring, AI-driven threat detection, and automation, but improvements in cost transparency, user experience, third-party integrations, and support for emerging technologies could make it even more effective. Addressing these areas would enhance its appeal for small-to-medium businesses, large enterprises, and organizations with complex or specialized IT environments.
As a 3rd party endpoint, SolarWinds Papertrail did exactly what it needed to. My hesitation is on the technical aptitude of the colleague receiving the recommendation, as the overall level of command line skill/understanding would have to be high. Web applications are a great solution here, but MOST of them already provide some sort of logging output. The scenario would definitely be in the situation where logging wasn't readily available in the current solution space. IF something like SolarWinds Papertrail was needed, it's probably the de facto thing that I would recommend.
I appreciate that it keeps the data within our, what we call our, authorization boundary. The fact that the data remains within Microsoft's, I guess, walled garden if you will, is very helpful for certain compliance needs in particular.
The large library of ingestion: ability to ingest is basically as easy as I can basically get it to be most of the time. There's occasionally some vendors that it's a little bit more challenging for, but given the ease of integration for a lot of things, basically it's become one of my requirements when I am looking at other tools is how easily do they integrate with Sentinel.
I think it should include more third party integration with non microsoft products as well as with other cloud providers. These integrations should be native.
It should improve ML and AI capabilities.
I find its documentation a little bit difficult to understand at the start. So the words should be simple.
The Microsoft Azure Sentinel solution is very good and even better if you use Azure. It's easy to implement and learn how to use the tool with an intuitive and simple interface. New updates are happening to always bring new news and improve the experience and usability. The solution brings reliability as it is from a very reliable manufacturer.
It's extremely easy to use. I and new colleagues have never had any issues configuring this tool or setting it up, it works almost out of the box with very simple instructions to follow to configure it to our own environment. I would highly recommend it on that ability alone.
I honestly have never had the need to use the support team, as we have not run into any issues so far. If we did however, judging from how the tool itself works, I don't doubt that the team would provide excellent support for any issues that we may possibly run into.
We decided to go with Microsoft Sentinel because it works really well with Microsoft tools we are already using. Microsoft Sentinel's intelligent features detect and resolve problems more quickly than Sumo Logic. It also allows us to pay for what we use and grow as we need. While Sumo Logic is good at analyzing data, Microsoft Sentinel fits our needs.
CloudWatch, by itself, is terrible at search. CloudWatch Insights works great and has powerful search capabilities, but it's more difficult to set up alerts. Also, because Insights charges per search, you have the potential to accumulate a large bill if you need to do many searches. I like that SolarWinds Papertrail has a known monthly cost.
As any cybersecurity product, this has to be more with risk to avoid loss in case of a ransomware that more than relate to a productivity increase. Maybe the impact could be that instead of having people that are checking 24/7 the dashboard, you could implement Sentinel and have less people checking that or people with less expertise. So the saving will be a minor but will be a saving in the cost of your team.
