Microsoft Sentinel vs. Splunk Enterprise Security

Splunk Enterprise Security

Overview
Product	Rating	Most Used By	Product Summary	Starting Price
Microsoft Sentinel	Score 8.6 out of 10	N/A	Microsoft Sentinel (formerly Azure Sentinel) is designed as a birds-eye view across the enterprise. It is presented as a security information and event management (SIEM) solution for proactive threat detection, investigation, and response.	$2.46 per GB ingested
Splunk Enterprise Security	Score 8.1 out of 10	N/A	Splunk Enterprise Security is an analytics-driven SIEM that helps to combat threats with actionable intelligence and advanced analytics at scale.	N/A

Pricing

Microsoft Sentinel

Splunk Enterprise Security

Editions & Modules

Azure Sentinel: $2.46
per GB ingested
100 GB per day: $123.00
per day
200 GB per day: $221.40
per day
300 GB per day: $319.80
per day
400 GB per day: $410.00
per day
500 GB per day: $492.00
per day
More than 500 GB per day: $492.00 + $98.40
per day/plus each additional 100 GB increment

No answers on this topic

Offerings

Pricing Offerings
Microsoft Sentinel	Splunk Enterprise Security
Free Trial
Yes	No
Free/Freemium Version
No	No
Premium Consulting/Integration Services
No	No

Entry-level Setup Fee

No setup fee

Additional Details

—

More Pricing Information

Pricing Info

Community Pulse
	Microsoft Sentinel	Splunk Enterprise Security
Considered Both Products	Microsoft Sentinel Verified User Anonymous Chose Microsoft Sentinel Compared to platforms such as Splunk, LogRhythm, and Devo, Microsoft Sentinel’s cloud‑native, consumption‑based pricing model and reduced infrastructure overhead tend to offer better overall cost efficiency. This is especially true for organizations already invested in the … Incentivized Helpful? Verified User Anonymous Chose Microsoft Sentinel These are all the Microsoft products. We have used Splunk. And again, I would say Microsoft Sentinel stacks up because it's a native tool that is more like an ecosystem. It's not a standalone tool. It's like if you're in the Microsoft stack, Microsoft Sentinel will stack up … Incentivized Helpful? Verified User Anonymous Chose Microsoft Sentinel Microsoft Sentinel gave us the opportunity to move to pay as you go model. This allows us to determine the value of a log source rather than paying a flat rate for data ingested or hosting a server ourself. Incentivized Helpful? Verified User Anonymous Chose Microsoft Sentinel Most of our landscape, both on prem and cloude, is based in Microsoft technologies, while the unification of tools implies some risk, decreasing the vendor levels simplify integrations, and by scale, help us to reduce costs too. Yes, the tool itself is a good contender, but the … Incentivized Helpful? Verified User Anonymous Chose Microsoft Sentinel They are for different use cases, field effect helps us monitor network traffic and decide what to do with it while Microsoft Defender Threat Intelligence allows more robust monitoring and control over 365 variables such as emails that come in and out and Entra ID information. Incentivized Helpful? Mohamad Islam Hamadieh SOC Engineer Chose Microsoft Sentinel Microsoft Sentinel feels on another different level from these solutions , all in the cloud . No need for troubleshooting , deployment or upgrades. Constant updates from the vendor and good support Incentivized Helpful? Verified User Anonymous Chose Microsoft Sentinel Microsoft Sentinel excels in cloud-native scalability, Microsoft ecosystem integration, and AI-driven threat detection with UEBA and Fusion rules, offering faster deployment and lower costs (48% cheaper per Forrester) than Splunk, QRadar, Exabeam, SentinelOne, Securonix, and … Incentivized Helpful? IS Ian Stuebe Project Manager Chose Microsoft Sentinel We decided to go with Microsoft Sentinel because it works really well with Microsoft tools we are already using. Microsoft Sentinel's intelligent features detect and resolve problems more quickly than Sumo Logic. It also allows us to pay for what we use and grow as we need. … Incentivized Helpful? Verified User Anonymous Chose Microsoft Sentinel Well, primarily we use different stuff like CrowdStrike. We use different sign-on features. We primarily use those different products because we support a wider ecosystem. Incentivized Helpful? RD Richard Dornhart National Security Practice Manager Chose Microsoft Sentinel Splunk, Google, SecOps. I look at how it stacks up based on the fact that it's the primary solution that we sell. So I think it stacks up really well. Why do we select it? Well, we selected it primarily because we're a very large Microsoft partner. The technology is very good … Incentivized Helpful? Verified User Anonymous Chose Microsoft Sentinel Well before there was Microsoft Sentinel, you had other competing products like ArcSight or Splunk, et cetera. I think they have their own qualities, but the Microsoft integration story is really why we're using it. Incentivized Helpful? HP Himanshu Pawar Manager Chose Microsoft Sentinel In my opinion, Microsoft Sentinel is much more reliable and Trustworthy. They are a bigger name with bigger scope of use. Incentivized Helpful? Verified User Anonymous Chose Microsoft Sentinel We use intune to protect endpoints and we pull logs from all the endpoints through the intune connector into the Microsoft Sentinel SIEM and that way we can run rules on those logs to find anomalies. Incentivized Helpful? Harshit Lal security consultant Chose Microsoft Sentinel it is easy to use Microsoft Sentinel and has faster deployment and advanced artificial intelligence than splunk Incentivized Helpful? Verified User Anonymous Chose Microsoft Sentinel Elastic seems to have a much better interface for log search and is able to filter out noise. Microsoft Sentinel also appears to generate a lot of false positives. Incentivized Helpful? Verified User Anonymous Chose Microsoft Sentinel Elastic is some carbon for various use cases. So because Elastic is a very, very wrong history in the market. So Sentinel is very recent for products from my understanding. Incentivized Helpful? Verified User Anonymous Chose Microsoft Sentinel Well, we didn't select, we selected Sentinel for our Azure stuff, our Microsoft stuff, but we do use a different SIEM for the other stuff still. Incentivized Helpful? Verified User Anonymous Chose Microsoft Sentinel Prior to using Sentinel, we were using Splunk specifically Splunk Enterprise Security and Splunk Cloud, so their on-prem and their cloud-based products. We switched originally for cost reasons, specifically cost control, but I have found that the ability to create reports, the … Incentivized Helpful? Verified User Anonymous Chose Microsoft Sentinel We've used Splunk before, but it really is just pick your poison. They're all very similar. Incentivized Helpful? Verified User Anonymous Chose Microsoft Sentinel Based on the overall infrastructure configuration that we have and also after analysing various solutions provided by Microsoft Sentinel, we came to a conclusion that the Microsoft Sentinel is the best option for us to help us in overall threat detection on our custom servers, … Incentivized Helpful? Ajay Sehgal Project Manager Chose Microsoft Sentinel Sentinel AI makes it a better choice. Also, its flexibility and customization make it a bit more costly than other competitors. Incentivized Helpful? EB Edward Broderick CISO Chose Microsoft Sentinel I use most of the Sims that are out there, but RSAs, old Sim Log, logic, elastic, a lot of them. Sumo, we checked out Sumo too. We're a Microsoft shop and live almost entirely on top of a Microsoft ecosystem. We are considering other Microsoft security products to integrate … Incentivized Helpful? Verified User Anonymous Chose Microsoft Sentinel The SecureWorks product is a more mature product. We prefer the SecureWorks product over Microsoft Sentinel at this point. Incentivized Helpful? Verified User Anonymous Chose Microsoft Sentinel As mentioned, the product was part of the purchase of several Microsoft Suites that we did earlier last year and with 200 licenses included, we can exclude those from the other SIEM and SOAR product, it just work well with the Microsoft's environment that we partially have Is … Incentivized Helpful? Verified User Anonymous Chose Microsoft Sentinel The key advantage of using Sentinel lies in Microsoft already being a renowned name in cloud services. Hence, the Collection of data at the cloud scale across all users, devices, applications, and infrastructure, both on-premises and especially in the MS Cloud, is super easy. … Incentivized Helpful?	Splunk Enterprise Security NJ Nikhil Jhawar Product Lead Chose Splunk Enterprise Security Ranks comparably Incentivized Helpful? Verified User Anonymous Chose Splunk Enterprise Security In my experience, Sentinel only works well for clients invested in azure. But the moment you step outside that ecosystem, mixing AWS , on prem and custom logs, things fall into shambles and feel fragmented Incentivized Helpful? Verified User Anonymous Chose Splunk Enterprise Security Before Splunk, we ran Elastic Security for our log aggregation and alerting platform. Unfortunately, the solution was not a good fit for many logs and mixed on-prem/cloud infrastructure, as our. For cost or small infrastructure, Elastic is a very good, strong, and credible … Incentivized Helpful? Verified User Anonymous Chose Splunk Enterprise Security The cost of Splunk Enterprise Security is very low as this can be hosted on private cloud. Google secops has very good UI and better log query speed and other features but cost sooo much. Incentivized Helpful? Saurabh Gupta Cyber Security Manager Chose Splunk Enterprise Security High-fidelity analytics with machine learning and customizable correlation rules. Incentivized Helpful? Verified User Anonymous Chose Splunk Enterprise Security The fact that it is used by many large companies was a strong reason for selecting Splunk Enterprise Security. After several demos and POCs, the teams were convinced of the value it brings: it demands the right amount of customization to fit with the company data sources. Also … Incentivized Helpful? Verified User Anonymous Chose Splunk Enterprise Security We piloted Sentinel for one of our regional logistics hubs but it struggled to handle our volume on-prem iot and telematics data cleanly. Splunk on the other hand gave us more control than its competitors Incentivized Helpful? Verified User Anonymous Chose Splunk Enterprise Security LogRhythm is good for a team comprising mostly non-technical IT users. Unlike Splunk, it has a GUI log search and a good ticketing system. Splunk is better than Logrhythm for me as it provides me with the ultimate flexibility to write custom queries. Scalyr is a good tool and … Incentivized Helpful? Sam Babbitt System/Network Administrator Chose Splunk Enterprise Security Imperva Web Application Firewall (WAF), Juniper Mist Edge, Wazuh Incentivized Helpful? Verified User Anonymous Chose Splunk Enterprise Security I did not choose this product. Overall although I like ES, I think Sentinel in certain ways is the superior product. The Kusto Query language is a lot easier to use. For instance anything that requires manual parsing in query can be more difficult with this product. Also some … Incentivized Helpful? Verified User Anonymous Chose Splunk Enterprise Security Splunk Enterprise Security (ES) is much faster and easier to integrate logs and work on alerts to detect suspicious security events. Incentivized Helpful? Verified User Anonymous Chose Splunk Enterprise Security AlienVault is much more user and beginner friendly, however Splunk ES very much so provides more capability for mass data manipulation, report and dashboard customization, and trend analytics. Incentivized Helpful? Verified User Anonymous Chose Splunk Enterprise Security These two really helps in better way and low cost and high productivity. Automatic detection ML help you to detect many ways and create cases based on risk score GRS UBA helps to protect organization from data ,via sharing through emails and USB s . Gurucu product license once … Incentivized Helpful? JC Joe Contreras Senior Security Specialist Chose Splunk Enterprise Security Splunk is way better. Support is awesome too Incentivized Helpful? Verified User Anonymous Chose Splunk Enterprise Security Splunk enterprise is the only solution that we’ve been able to identify that provides risk based alerting, which allows our SOC to reduce analyst fatigue which would be a huge problem without it. Before RBA, there were thousands of alerts a day and it was impossible to review … Incentivized Helpful? Verified User Anonymous Chose Splunk Enterprise Security I believe it is definitely a leader in the security space Incentivized Helpful? Verified User Anonymous Chose Splunk Enterprise Security I consider Splunk Enterprise Security to have the strongest deployment methodology and troubleshoot features. Other products also provide good solutions such as Riverbed, Broadcom and Solarwinds but I think Splunk Enterprise Security is a great and trustable option to use for … Incentivized Helpful? Verified User Anonymous Chose Splunk Enterprise Security Even though Splunk ES is not the cheapest solution on the markt, we found it was still cheaper compared to Secureworks we had before. Also the level of flexibility and "thinking with the customer" is much better now. Incentivized Helpful? Ramu S R Junior Network Administrator Chose Splunk Enterprise Security Traditional hardware logging mechanisms do not provide in-depth research data on the threats and signatures, while Splunk Enterprise Security could easily achieve this feat. Incentivized Helpful? AMJITH LAL S Senior Network Administrator Chose Splunk Enterprise Security FortiAnalzer is a hardware solution, but with Splunk, we could identify as well get the correct solution for the active threats and too with accurate and precise detailing. Incentivized Helpful? Verified User Anonymous Chose Splunk Enterprise Security - Schema on the fly indexing --> Gives you faster index searches. Even if you use Datamodes, it's 100x time faster as well. - Correlation with other domains easily gives you total visibility and reduces the time to investigate and understand the problem. - With lookups and trust, … Incentivized Helpful? Verified User Anonymous Chose Splunk Enterprise Security Securonix does not nearly meet the scale, extensibility, and maturity that Splunk ES offers. However, when looking at the MSP architecture options, Securonix is a much more flexible platform for multi-tenanting. So, Splunk ES for captive SOC platforms and Securonix for … Incentivized Helpful? Saibal Banerjee Cyber Security Consultant Chose Splunk Enterprise Security Splunk ES is by far the best solution in the market as per flexibility, features and support. Cost-wise, it is the most expensive option to go with, but that has its own advantages as the product that we get is premium and superior to other SIEM. The best thing about Spunk ES … Incentivized Helpful? Jacob Gonzales IDS/SIEM Engineering Supervisor Chose Splunk Enterprise Security Splunk Enterprise Security allows for data normalization that does not compare to other SIEMs such as QRadar or Trustwave. QRadar requires custom dsm parsers before the data can be onboarded. I appreciate that Splunk Enterprise Security can ingest any source of data and … Incentivized Helpful? Verified User Anonymous Chose Splunk Enterprise Security N/A - Have only used Splunk Enterprise Security since coming to Deloitte Incentivized Helpful?

Features

Microsoft Sentinel

Splunk Enterprise Security

Security Information and Event Management (SIEM)

Comparison of Security Information and Event Management (SIEM) features of Product A and Product B
	Microsoft Sentinel 8.1 Ratings 3% above category average	Splunk Enterprise Security 8.1 Ratings 3% above category average
Centralized event and log data collection	8.70 Ratings	7.60 Ratings
Correlation	8.60 Ratings	8.90 Ratings
Event and log normalization/management	8.10 Ratings	8.90 Ratings
Deployment flexibility	6.90 Ratings	7.00 Ratings
Integration with Identity and Access Management Tools	8.50 Ratings	8.00 Ratings
Custom dashboards and workspaces	8.00 Ratings	8.90 Ratings
Host and network-based intrusion detection	8.30 Ratings	8.00 Ratings
Data integration/API management	8.00 Ratings	7.90 Ratings
Behavioral analytics and baselining	8.10 Ratings	7.40 Ratings
Rules-based and algorithmic detection thresholds	8.40 Ratings	8.50 Ratings
Response orchestration and automation	8.40 Ratings	7.50 Ratings
Reporting and compliance management	7.30 Ratings	8.90 Ratings
Incident indexing/searching	8.40 Ratings	8.00 Ratings

Best Alternatives
	Microsoft Sentinel	Splunk Enterprise Security
Small Businesses	LevelBlue USM Anywhere Score 8.0 out of 10	LevelBlue USM Anywhere Score 8.0 out of 10
Medium-sized Companies	Sumo Logic Score 8.8 out of 10	Sumo Logic Score 8.8 out of 10
Enterprises	Sumo Logic Score 8.8 out of 10	Sumo Logic Score 8.8 out of 10
All Alternatives	View all alternatives	View all alternatives

User Ratings
	Microsoft Sentinel	Splunk Enterprise Security
Likelihood to Recommend	8.3 (0 ratings)	7.0 (0 ratings)
Likelihood to Renew	6.6 (0 ratings)	9.1 (0 ratings)
Usability	7.1 (0 ratings)	7.1 (0 ratings)
Availability	- (0 ratings)	9.1 (0 ratings)
Performance	- (0 ratings)	7.0 (0 ratings)
Support Rating	8.0 (0 ratings)	7.3 (0 ratings)
In-Person Training	- (0 ratings)	9.1 (0 ratings)
Online Training	- (0 ratings)	8.2 (0 ratings)
Implementation Rating	- (0 ratings)	9.1 (0 ratings)
Configurability	- (0 ratings)	7.3 (0 ratings)
Ease of integration	- (0 ratings)	6.4 (0 ratings)
Product Scalability	- (0 ratings)	8.7 (0 ratings)
Vendor post-sale	- (0 ratings)	8.2 (0 ratings)
Vendor pre-sale	- (0 ratings)	8.2 (0 ratings)

User Testimonials
	Microsoft Sentinel	Splunk Enterprise Security
Likelihood to Recommend	It's certainly well-suited in environments that rely heavily on Microsoft products, and it's well-suited for environments where you have other business drivers to go to the E5 license. If I were to say where I would not and why, I only gave it a seven on the recommendation, that answer would probably vary if you already owned E5 or not. It's extremely expensive. And if there are other alternatives, if you don't have any other driving reason to go to E5, I would coach you not to go to Microsoft Sentinel. But if you're there, it's a fantastic property. It's certainly part of the cost argument for moving to E5, but it's only a part. It can't by itself justify the move to E5. Incentivized Verified User Anonymous Read full review	Well suited: Splunk ES is highly recommended in an environment with many data sources and experienced computer engineers. It has a steep learning curve, but once that hurdle is crossed, it is absolutely a beast. It is also very expensive, so a company putting a high amount of budget in Security is needed. Not well suited: Splunk ES is not recommended if a company has only a few sources and some non-technical IT users. The price won't justify the fewer data sources and scratching just the surface level. Moreover, non-technical IT users would be better off with something that has a query builder, unlike Splunk. Incentivized Verified User Anonymous Read full review
Pros	It's mainly the data correlation. For example, in the Microsoft ecosystem, Microsoft Entra ID is a primary component of the authentication and authorization mechanism. So whenever you're using tools like Microsoft Intune, Defender for Endpoint, Entra ID is the key signal, right? So Microsoft Sentinel correlates the logs from all these devices and services very well, so I can see a very detailed attack shape to figure out what's going on. Incentivized Verified User Anonymous Read full review	Its best feature is its user interface, which is easy to navigate and understand. All you need is a little tutorial on how to use the Splunk query language and you're done. Logs can be easily uploaded or shared across multiple platforms and display a highly insightful graphical representations of data using graphs, tables, and many other formats. Incentivized Verified User Anonymous Read full review
Cons	I think it should include more third party integration with non microsoft products as well as with other cloud providers. These integrations should be native. It should improve ML and AI capabilities. I find its documentation a little bit difficult to understand at the start. So the words should be simple. Incentivized Verified User Anonymous Read full review	ES on the cloud (SaaS) has too many limitations with platform administration. Supported integrations are not always on par with enterprise support especially when dependent on 3rd-party proprietary APIs. In later versions, unforeseen glitches seem to show up that have no resolution except version upgrade. This used to not be the case in prior versions which were very stable. Verified User Anonymous Read full review
Likelihood to Renew	it does the job reasonably well Incentivized Verified User Anonymous Read full review	We are very happy with Splunk and would advise anyone to take a serious look at it. It might look pricey but the rewards Splunk offers seem endless. Incentivized Verified User Anonymous Read full review
Usability	The Microsoft Azure Sentinel solution is very good and even better if you use Azure. It's easy to implement and learn how to use the tool with an intuitive and simple interface. New updates are happening to always bring new news and improve the experience and usability. The solution brings reliability as it is from a very reliable manufacturer. Incentivized Flavio Pereira Analista de sistemas Read full review	Maintaining hundreds or even 1000+ SOC use cases is really difficult, considering that the Data sources may not always send the data. A module that detects data freshness issues and detect data format changes would be a great help. the main challenge today using Splunk Enterprise Security is making sure that the detection rules are still working properly given all the changes that occur in data source applications. Also, maintaining the data collects on tens of thousands of servers and more than 100k workstations is a real company IT challenge: the splunkbase forwarder may not support old OS anymore, while these are the most important to monitor. Moving to the Open Telemetry collector has become essential so that only 1 agent is required for both SIEM and application observability. Incentivized Verified User Anonymous Read full review
Reliability and Availability	No answers on this topic	I don't think I've ever seen Splunk ES go fully offline or have any downtime greater than a few minutes on rare occasions. Incentivized Verified User Anonymous Read full review
Performance	No answers on this topic	It takes a long time for items to load if you are just generally searching through logs. It is best to use the data models which load faster but can be strange in terms of what is coming from which logs where. Yes, you can look it up, but this also requires familiarity with where things are and how to look them up. Incentivized Verified User Anonymous Read full review
Support Rating	Azure Sentinel is very easy to use and configure. If you are stuck somewhere, Microsoft support is excellent in assisting and solving your issue. Incentivized Verified User Anonymous Read full review	It's good when it's responsive, but I've had times where I had to wait quite a while for a response. But these are typically the exceptions rather than the rule. When you do get a response it is always well-informed and appropriate. I would say they've been trending better over time with this. Incentivized AE Allan Crittenden Edwards Security Analyst Read full review
In-Person Training	No answers on this topic	I experienced only on-line training, but the trainers were very professional and competent. Maybe it could be more useful if they also have an experience in projects because sometimes they didn't have a real project experience to communicate to the students. Anyway, it was very interesting and I learned many thing that's very difficoult (or maybe impossible!) to have by myself, aven if I have more than 10 years of Splunk activity experience. Incentivized Giuseppe Cusello GRC Director Read full review
Online Training	No answers on this topic	It was very interesting and I learned many thing that's very difficoult (or maybe impossible!) to have by myself. The only problem was that, when I worked with the Splunk Professional Services, I found some difference between the training contents and the information from PS. In addition is required a long experience on Splunk Enterprise for the data ingestion part, in other words I'm able to work with ES because I'm worling on Splunk since 11 years, otherwise I'd some problem. Incentivized Giuseppe Cusello GRC Director Read full review
Implementation Rating	No answers on this topic	It's a fantatic product and it was very useful the presence of Splunk Professional Services for the Design Phase and the final Health Check. Incentivized Giuseppe Cusello GRC Director Read full review
Alternatives Considered	Compared to platforms such as Splunk, LogRhythm, and Devo, Microsoft Sentinel’s cloud‑native, consumption‑based pricing model and reduced infrastructure overhead tend to offer better overall cost efficiency. This is especially true for organizations already invested in the Microsoft ecosystem, where Sentinel can deliver strong capabilities with a lower total cost of ownership. Incentivized Verified User Anonymous Read full review	Before Splunk, we ran Elastic Security for our log aggregation and alerting platform. Unfortunately, the solution was not a good fit for many logs and mixed on-prem/cloud infrastructure, as our. For cost or small infrastructure, Elastic is a very good, strong, and credible choice. But if you need a performant SIEM, enjoy Splunk. Incentivized Verified User Anonymous Read full review
Scalability	No answers on this topic	We have on prem splunk and it’s mostly east to setup, but we have issues keeping data separated between customer splunk deployments while at the same time only having to look at one SIEM to address events in every environment Incentivized Verified User Anonymous Read full review
Return on Investment	It's probably neutral. We see value, but it's, again, tick that kind of expense stuff. We're getting more insight and value into what is going on in that cloud workspace, but just noting the cost. So it's probably neutral. I'm not directly responsible, so the full kind of return on investment kind of cycle, that's someone else's problem. I'm like the end user. It's my team that will look at the data and look at the output of Microsoft Sentinel. So the ROI, someone else can worry about that. Incentivized Verified User Anonymous Read full review	Swift Incident Response: ES's real-time monitoring and correlation capabilities have notably reduced our mean time to detect (MTTD) and respond (MTTR) to security incidents. Cost Efficiency: ES streamlined operations, lowering operational costs through task automation and effective resource allocation. Compliance Simplification: ES's robust reporting and compliance features have eased audits, reducing related costs and efforts. Incentivized Verified User Anonymous Read full review
ScreenShots	Microsoft Sentinel Screenshots