Microsoft Sentinel vs. Splunk Enterprise vs. Trellix Enterprise Security Manager

Splunk Enterprise

Trellix Enterprise Security Manager

Overview
Product	Rating	Most Used By	Product Summary	Starting Price
Microsoft Sentinel	Score 8.6 out of 10	N/A	Microsoft Sentinel (formerly Azure Sentinel) is designed as a birds-eye view across the enterprise. It is presented as a security information and event management (SIEM) solution for proactive threat detection, investigation, and response.	$2.46 per GB ingested
Splunk Enterprise	Score 8.6 out of 10	N/A	Splunk is software for searching, monitoring, and analyzing machine-generated big data, via a web-style interface. It captures, indexes and correlates real-time data in a searchable repository from which it can generate graphs, reports, alerts, dashboards and visualizations.	N/A
Trellix Enterprise Security Manager	Score 8.6 out of 10	N/A	Trellix Enterprise Security Manager (formerly McAfee Enterprise Security Manager) is security information and event management (SIEM) software.	N/A

Pricing

Microsoft Sentinel

Splunk Enterprise

Trellix Enterprise Security Manager

Editions & Modules

Azure Sentinel: $2.46
per GB ingested
100 GB per day: $123.00
per day
200 GB per day: $221.40
per day
300 GB per day: $319.80
per day
400 GB per day: $410.00
per day
500 GB per day: $492.00
per day
More than 500 GB per day: $492.00 + $98.40
per day/plus each additional 100 GB increment

No answers on this topic

Offerings

Pricing Offerings
Microsoft Sentinel	Splunk Enterprise	Trellix Enterprise Security Manager
Free Trial
Yes	Yes	No
Free/Freemium Version
No	Yes	No
Premium Consulting/Integration Services
No	No	No

Entry-level Setup Fee

No setup fee

Additional Details

—

More Pricing Information

Pricing Info

Community Pulse
	Microsoft Sentinel	Splunk Enterprise	Trellix Enterprise Security Manager
Considered Multiple Products	Microsoft Sentinel Verified User Anonymous Chose Microsoft Sentinel Compared to platforms such as Splunk, LogRhythm, and Devo, Microsoft Sentinel’s cloud‑native, consumption‑based pricing model and reduced infrastructure overhead tend to offer better overall cost efficiency. This is especially true for organizations already invested in the … Incentivized Helpful? Verified User Anonymous Chose Microsoft Sentinel These are all the Microsoft products. We have used Splunk. And again, I would say Microsoft Sentinel stacks up because it's a native tool that is more like an ecosystem. It's not a standalone tool. It's like if you're in the Microsoft stack, Microsoft Sentinel will stack up … Incentivized Helpful? Verified User Anonymous Chose Microsoft Sentinel Microsoft Sentinel gave us the opportunity to move to pay as you go model. This allows us to determine the value of a log source rather than paying a flat rate for data ingested or hosting a server ourself. Incentivized Helpful? Verified User Anonymous Chose Microsoft Sentinel Most of our landscape, both on prem and cloude, is based in Microsoft technologies, while the unification of tools implies some risk, decreasing the vendor levels simplify integrations, and by scale, help us to reduce costs too. Yes, the tool itself is a good contender, but the … Incentivized Helpful? Verified User Anonymous Chose Microsoft Sentinel They are for different use cases, field effect helps us monitor network traffic and decide what to do with it while Microsoft Defender Threat Intelligence allows more robust monitoring and control over 365 variables such as emails that come in and out and Entra ID information. Incentivized Helpful? Mohamad Islam Hamadieh SOC Engineer Chose Microsoft Sentinel Microsoft Sentinel feels on another different level from these solutions , all in the cloud . No need for troubleshooting , deployment or upgrades. Constant updates from the vendor and good support Incentivized Helpful? Verified User Anonymous Chose Microsoft Sentinel Microsoft Sentinel excels in cloud-native scalability, Microsoft ecosystem integration, and AI-driven threat detection with UEBA and Fusion rules, offering faster deployment and lower costs (48% cheaper per Forrester) than Splunk, QRadar, Exabeam, SentinelOne, Securonix, and … Incentivized Helpful? IS Ian Stuebe Project Manager Chose Microsoft Sentinel We decided to go with Microsoft Sentinel because it works really well with Microsoft tools we are already using. Microsoft Sentinel's intelligent features detect and resolve problems more quickly than Sumo Logic. It also allows us to pay for what we use and grow as we need. … Incentivized Helpful? Verified User Anonymous Chose Microsoft Sentinel Well, primarily we use different stuff like CrowdStrike. We use different sign-on features. We primarily use those different products because we support a wider ecosystem. Incentivized Helpful? RD Richard Dornhart National Security Practice Manager Chose Microsoft Sentinel Splunk, Google, SecOps. I look at how it stacks up based on the fact that it's the primary solution that we sell. So I think it stacks up really well. Why do we select it? Well, we selected it primarily because we're a very large Microsoft partner. The technology is very good … Incentivized Helpful? Verified User Anonymous Chose Microsoft Sentinel Well before there was Microsoft Sentinel, you had other competing products like ArcSight or Splunk, et cetera. I think they have their own qualities, but the Microsoft integration story is really why we're using it. Incentivized Helpful? HP Himanshu Pawar Manager Chose Microsoft Sentinel In my opinion, Microsoft Sentinel is much more reliable and Trustworthy. They are a bigger name with bigger scope of use. Incentivized Helpful? Verified User Anonymous Chose Microsoft Sentinel We use intune to protect endpoints and we pull logs from all the endpoints through the intune connector into the Microsoft Sentinel SIEM and that way we can run rules on those logs to find anomalies. Incentivized Helpful? Harshit Lal security consultant Chose Microsoft Sentinel it is easy to use Microsoft Sentinel and has faster deployment and advanced artificial intelligence than splunk Incentivized Helpful? Verified User Anonymous Chose Microsoft Sentinel Elastic seems to have a much better interface for log search and is able to filter out noise. Microsoft Sentinel also appears to generate a lot of false positives. Incentivized Helpful? Verified User Anonymous Chose Microsoft Sentinel Elastic is some carbon for various use cases. So because Elastic is a very, very wrong history in the market. So Sentinel is very recent for products from my understanding. Incentivized Helpful? Verified User Anonymous Chose Microsoft Sentinel Well, we didn't select, we selected Sentinel for our Azure stuff, our Microsoft stuff, but we do use a different SIEM for the other stuff still. Incentivized Helpful? Verified User Anonymous Chose Microsoft Sentinel Prior to using Sentinel, we were using Splunk specifically Splunk Enterprise Security and Splunk Cloud, so their on-prem and their cloud-based products. We switched originally for cost reasons, specifically cost control, but I have found that the ability to create reports, the … Incentivized Helpful? Verified User Anonymous Chose Microsoft Sentinel We've used Splunk before, but it really is just pick your poison. They're all very similar. Incentivized Helpful? Verified User Anonymous Chose Microsoft Sentinel Based on the overall infrastructure configuration that we have and also after analysing various solutions provided by Microsoft Sentinel, we came to a conclusion that the Microsoft Sentinel is the best option for us to help us in overall threat detection on our custom servers, … Incentivized Helpful? Ajay Sehgal Project Manager Chose Microsoft Sentinel Sentinel AI makes it a better choice. Also, its flexibility and customization make it a bit more costly than other competitors. Incentivized Helpful? EB Edward Broderick CISO Chose Microsoft Sentinel I use most of the Sims that are out there, but RSAs, old Sim Log, logic, elastic, a lot of them. Sumo, we checked out Sumo too. We're a Microsoft shop and live almost entirely on top of a Microsoft ecosystem. We are considering other Microsoft security products to integrate … Incentivized Helpful? Verified User Anonymous Chose Microsoft Sentinel The SecureWorks product is a more mature product. We prefer the SecureWorks product over Microsoft Sentinel at this point. Incentivized Helpful? Verified User Anonymous Chose Microsoft Sentinel As mentioned, the product was part of the purchase of several Microsoft Suites that we did earlier last year and with 200 licenses included, we can exclude those from the other SIEM and SOAR product, it just work well with the Microsoft's environment that we partially have Is … Incentivized Helpful? Verified User Anonymous Chose Microsoft Sentinel The key advantage of using Sentinel lies in Microsoft already being a renowned name in cloud services. Hence, the Collection of data at the cloud scale across all users, devices, applications, and infrastructure, both on-premises and especially in the MS Cloud, is super easy. … Incentivized Helpful?	Splunk Enterprise Verified User Anonymous Chose Splunk Enterprise Personally, I haven't really looked at anything else that really hasn't been my domain, so not until recently. Incentivized Helpful? Verified User Anonymous Chose Splunk Enterprise CrowdStrike Next-Gen SIEM Incentivized Helpful? Verified User Anonymous Chose Splunk Enterprise Splunk could sort a much better log correlation than it competitors. dynatrace have better dashboards, but its harder to setup and in our case, way too expensive. with Splunk, no one regrets migrating from Qradar. it looks like different generations tools. the correlation is … Incentivized Helpful? SN Santosh Nukala student Chose Splunk Enterprise In our opinion, Splunk Enterprise is better Incentivized Helpful? Verified User Anonymous Chose Splunk Enterprise Splunk is costly, but easier to maintain. Reliability is a key factor, and most products have issue. While DataDog is very costly, even to Splunk. Incentivized Helpful? Verified User Anonymous Chose Splunk Enterprise Splunk Enterprise has been a well-established solution for many clients for a long time and is a major player in the market. Its track record and performance make it the best choice. Furthermore, its ease of use for developing, using, and managing data makes it the best among … Incentivized Helpful? Eric Galipaud Network Ingeneer Chose Splunk Enterprise Splunk Enterprise stands out compared to other solutions due to its broad compatibility and flexibility. It integrates easily with a wide range of infrastructure, network, security, and application products, thanks to its support for multiple data formats and its extensive … Incentivized Helpful? Verified User Anonymous Chose Splunk Enterprise Splunk is the undisputed leader in Security Information and Event Management. Splunk Enterprise Security allows for massive, complex correlation of data across disparate sources. It can be deployed entirely on-premise or in a private cloud, giving total "data sovereignty." … Incentivized Helpful? Verified User Anonymous Chose Splunk Enterprise Elastic Beats and Apache Kafka Incentivized Helpful? Verified User Anonymous Chose Splunk Enterprise Okay for dashboards but very limited for ad-hoc searches, no deep dive Incentivized Helpful? Verified User Anonymous Chose Splunk Enterprise Splunk Enterprise stacks similarly to IBM's qradar and outperforms both Palo Alto's Panorama and Cisco's Secure Firewall Management Center in regards to storing large amounts of logs and the ability for quick searches. Splunk Enterprise handles queries of data effectively and … Incentivized Helpful? Verified User Anonymous Chose Splunk Enterprise Splunk Enterprise is a very seasoned software , while other comparable software keep on adding new features and keep evolving, Splunk Enterprise has reached a state where new user onboarded doesnt have to request any basic feature or develop modules to simple tasks. Log parsing … Incentivized Helpful? Verified User Anonymous Chose Splunk Enterprise Splunk does a good job at log aggregation and compatibility however, integrations with other products is been a challenge. Especially the pricing can be more competitive to spice up the market and orgs looking to explore AI based logging over traditional practices. Incentivized Helpful? NU Nitin Umbardand Director Cybersecurity Business Chose Splunk Enterprise Able to show more than Log data in Splunk views, we tested several plug-ins during a small pilot, and we were able to bring O/S (Win/Unix/Linux) & APM data metrics into the same views as Logged data. I've seen others use it to visualize a wider range of data types, too...better … Incentivized Helpful? Verified User Anonymous Chose Splunk Enterprise While both are market-leading SIEM platforms, they cater to different environments and organization priorities. The choice often comes down to a company's existing infrastructure, integration needs, and long-term security strategy. Deployment and architecture - Splunk offeres … Incentivized Helpful? Verified User Anonymous Chose Splunk Enterprise They do provide an overwhelming level of information, which is hard to use. Incentivized Helpful? Verified User Anonymous Chose Splunk Enterprise Splunk features of storing data and ingestion of logs , indexing of data , data analytics make is superior to other tools. Definately there is more improvement requirement in terms of visualisation of data but one stop for all features make splunk better than various other … Incentivized Helpful? Verified User Anonymous Chose Splunk Enterprise Splunk Enterprise was already chosen by our organization to be used across teams. However, the reasoning I know behind is the ability to share events/messages across different message brokers and making onboarding easier to legacy teams by just simple configuration. Incentivized Helpful? Verified User Anonymous Chose Splunk Enterprise Splunk was better in terms of analyzing unstructured data. Also Splunk has had a very good and strong community and is also has a more tried and tested performance. I personally found the dash boarding capability of Splunk better than datadog. We also analyzed using Kibana. … Incentivized Helpful? Verified User Anonymous Chose Splunk Enterprise Omnibus was a Linux based tool. Not very easy to sue. End user needs to know Linux commands. Splunk Enterprise is more flexible and ease to use. Splunk Enterprise can generate reports, graphs, data visualization, data validation and much more. Use friendly query language and … Incentivized Helpful? Verified User Anonymous Chose Splunk Enterprise A lot of products have natively inside their own dashboards and or their own logging repositories. And each one is difficult to learn or they're too complex or they're not verbose in the sense that they're not easy to mine the data that you're looking for. So that could be … Incentivized Helpful? Verified User Anonymous Chose Splunk Enterprise Elastic and it's a little bit more cumbersome and a little bit more time consuming. Using Splunk is much easier flow and quicker to utilize to get to the root of a problem. Incentivized Helpful? Verified User Anonymous Chose Splunk Enterprise Splunk AppDynamics and Elastic Observability Incentivized Helpful? Verified User Anonymous Chose Splunk Enterprise Cost was major factor which made us choose Splunk Enterprisek. Splunk Enterprise is versatile tool which further helped us to make our decision. Apart from that Managment wish to use something robust hence Splunk Enterprise became there first choice. Incentivized Helpful? Verified User Anonymous Chose Splunk Enterprise Splunk Enterprise is honestly the first tool we used and we cant realistically switch. We have not done any in depth studies or comparisons. We know there are alternatives and we would probably switch if one of them was much more economically viable, but right now we are happy … Incentivized Helpful?	Trellix Enterprise Security Manager Verified User Anonymous Chose Trellix Enterprise Security Manager McAfee Enterprise Security Manager is a better option than other security software because it's both inexpensive and extremely effective. Norton and other security software boast a high price tag but don't always back it up when it comes to performance. With McAfee Enterprise … Incentivized Helpful? Fernanda Ministerio Especialista de Desenvolvimento Industrial Chose Trellix Enterprise Security Manager Other evaluated products: Microsoft Defender and Symantec - McAffee has more comprehensive integrated tools that better serve our infrastructure - Analysts found the use of the tool more intuitive Incentivized Helpful? Verified User Anonymous Chose Trellix Enterprise Security Manager McAfee is not the easiest tool to use. The user interface (specially the admin part) is fairly confusing. At first, McAfee is very overwhelming and not so easy to understand. However, once you get used to the tool, you get used to the interface and you're able to do pretty much … Incentivized Helpful? Brandon Macapelit, CISA IT Auditor Chose Trellix Enterprise Security Manager We had used McAfee Enterprise Security Manager for a long time, and it served us well. It is great since it can serve as an all-in security tool. Also, it was a great deal for our organization, since it came bundled with our manager network security. Incentivized Helpful? NJ Neil Johnson CIO (Chief Information Officer) Chose Trellix Enterprise Security Manager We selected McAfee Enterprise Security Manager because the pricing is competitive in the industry. It is very reliable. The vendor offers good support in real time. Offers the results that we have been looking for. The ability to get the logs may be of last 2 years in a matter … Incentivized Helpful? Verified User Anonymous Chose Trellix Enterprise Security Manager We selected and implemented McAfee Enterprise Security Manager because is the best SIEM solution from the market. With a very good support from the vendor. Easy implementation and easy management. A lot of threats addressed. High level of security assured. Very good resilience. … Incentivized Helpful? Verified User Anonymous Chose Trellix Enterprise Security Manager Splunk tends to be the top dog in the space. Everything is compatible and it's capable of anything. You just have to have the time and money to do the work. And if you have a large volume of logs (and who doesn't?), it's not cheap. McAfee Enterprise Security Manager's advantage … Incentivized Helpful? PC Philip Clarke IT Systems/Security Manager Chose Trellix Enterprise Security Manager We looked at a few products, these were AlienVault, ESM, LogRhythm and Alert Logic. ESM at the time had more functionality and a friendlier and cleaner user interface than LogRhythm ESM had an ability to integrate easily into Intel's endpoint solution versus AlienVault where a … Incentivized Helpful? Alex Waitkus, CISSP-ISSAP, OSCP Security Architect Chose Trellix Enterprise Security Manager ESM is to top when it comes to central management. Yhe more tools it can manage the better. Incentivized Helpful?

Features

Microsoft Sentinel

Splunk Enterprise

Trellix Enterprise Security Manager

Security Information and Event Management (SIEM)

Comparison of Security Information and Event Management (SIEM) features of Product A and Product B
	Microsoft Sentinel 8.1 Ratings 2% above category average	Splunk Enterprise 8.2 Ratings 4% above category average	Trellix Enterprise Security Manager 8.4 Ratings 6% above category average
Centralized event and log data collection	8.70 Ratings	9.00 Ratings	8.60 Ratings
Correlation	8.60 Ratings	8.40 Ratings	7.00 Ratings
Event and log normalization/management	8.10 Ratings	8.40 Ratings	8.00 Ratings
Deployment flexibility	6.90 Ratings	8.00 Ratings	8.30 Ratings
Integration with Identity and Access Management Tools	8.50 Ratings	8.20 Ratings	9.30 Ratings
Custom dashboards and workspaces	8.00 Ratings	8.70 Ratings	9.30 Ratings
Host and network-based intrusion detection	8.30 Ratings	7.80 Ratings	8.30 Ratings
Data integration/API management	8.00 Ratings	8.30 Ratings	9.30 Ratings
Behavioral analytics and baselining	8.10 Ratings	7.70 Ratings	8.60 Ratings
Rules-based and algorithmic detection thresholds	8.40 Ratings	7.80 Ratings	8.60 Ratings
Response orchestration and automation	8.40 Ratings	7.50 Ratings	8.00 Ratings
Reporting and compliance management	7.30 Ratings	8.60 Ratings	8.60 Ratings
Incident indexing/searching	8.40 Ratings	8.70 Ratings	7.60 Ratings

Best Alternatives
	Microsoft Sentinel	Splunk Enterprise	Trellix Enterprise Security Manager
Small Businesses	LevelBlue USM Anywhere Score 8.0 out of 10	LevelBlue USM Anywhere Score 8.0 out of 10	LevelBlue USM Anywhere Score 8.0 out of 10
Medium-sized Companies	Sumo Logic Score 8.8 out of 10	Sumo Logic Score 8.8 out of 10	Sumo Logic Score 8.8 out of 10
Enterprises	Sumo Logic Score 8.8 out of 10	Sumo Logic Score 8.8 out of 10	Sumo Logic Score 8.8 out of 10
All Alternatives	View all alternatives	View all alternatives	View all alternatives

User Ratings
	Microsoft Sentinel	Splunk Enterprise	Trellix Enterprise Security Manager
Likelihood to Recommend	8.3 (0 ratings)	8.7 (0 ratings)	9.0 (0 ratings)
Likelihood to Renew	6.6 (0 ratings)	8.5 (0 ratings)	- (0 ratings)
Usability	7.0 (0 ratings)	8.5 (0 ratings)	- (0 ratings)
Availability	- (0 ratings)	10.0 (0 ratings)	- (0 ratings)
Support Rating	8.0 (0 ratings)	8.0 (0 ratings)	6.5 (0 ratings)
Online Training	- (0 ratings)	8.0 (0 ratings)	- (0 ratings)
Implementation Rating	- (0 ratings)	7.0 (0 ratings)	- (0 ratings)
Product Scalability	- (0 ratings)	9.1 (0 ratings)	- (0 ratings)

User Testimonials
	Microsoft Sentinel	Splunk Enterprise	Trellix Enterprise Security Manager
Likelihood to Recommend	It's certainly well-suited in environments that rely heavily on Microsoft products, and it's well-suited for environments where you have other business drivers to go to the E5 license. If I were to say where I would not and why, I only gave it a seven on the recommendation, that answer would probably vary if you already owned E5 or not. It's extremely expensive. And if there are other alternatives, if you don't have any other driving reason to go to E5, I would coach you not to go to Microsoft Sentinel. But if you're there, it's a fantastic property. It's certainly part of the cost argument for moving to E5, but it's only a part. It can't by itself justify the move to E5. Incentivized Verified User Anonymous Read full review	I'm liking the newer products, and I'm looking forward to how they integrate with the overall product when they come together. Just log in and be able to query a large number of systems for similar issues or a unique one. That is a great fit for Splunk Enterprise, looking for a simple case or a simple String or something of that nature across multiple machines. It's a great fit for that to identify issues or particular software, whatever your scenario is, String, to find it across any particular server or group of servers, so that you can update or do a deployment or whatever it is you're looking to do. Incentivized Verified User Anonymous Read full review	McAfee is a good solution if you're in a medium/large company and if you're looking for a solution that can be customized and expanded. I also recommend if you have the most common log sources on your environment, since McAfee supports the major log sources (but lack a lot of small vendors). In my opinion, I wouldn't recommend McAfee for small companies, since it's not that easy to manage and maintain. Incentivized Verified User Anonymous Read full review
Pros	It's mainly the data correlation. For example, in the Microsoft ecosystem, Microsoft Entra ID is a primary component of the authentication and authorization mechanism. So whenever you're using tools like Microsoft Intune, Defender for Endpoint, Entra ID is the key signal, right? So Microsoft Sentinel correlates the logs from all these devices and services very well, so I can see a very detailed attack shape to figure out what's going on. Incentivized Verified User Anonymous Read full review	Real-time + Scheduled alerts - i-e you can set up alerts which are actively monitoring your logs Pretty good response time for search results. With our key/value logging, Splunk makes it blazing fast to query the data. Dashboards provide insights into historical data Love how Splunk indexes all of the data and provides keys to search on Incentivized Pooja Gada Engineering Tech Lead Read full review	McAfee Enterprise Security Manager has a large library of pre-made correlations that reduces the amount of work needed to make it functional. This is a core McAfee product that is still getting support. It has a substantial amount of compatibility and integration with other products. Incentivized Verified User Anonymous Read full review
Cons	I think it should include more third party integration with non microsoft products as well as with other cloud providers. These integrations should be native. It should improve ML and AI capabilities. I find its documentation a little bit difficult to understand at the start. So the words should be simple. Incentivized Verified User Anonymous Read full review	At times some queries can run slowly if indices are not on a portion of the query you use. Setup time initially can be difficult if your logs aren't stored in common locations or in a common way to write the log. Ability to ingest logs from different locations without having to change code to put logs in a certain place (pro and con). Searches can be a bit more difficult to look through if your log isn't pulled in a manner that is easy to read through splunk. Incentivized Verified User Anonymous Read full review	If there is a requirement to integrate into other vendor products i.e. (log sharing) then this was very cumbersome. Integration of vulnerability scanning that is available in other vendor products would be a good addition. When integrating all of Intel's products a third party consultancy is usually required, where other vendor products can be configured without this additional cost. Incentivized PC Philip Clarke IT Systems/Security Manager Read full review
Likelihood to Renew	it does the job reasonably well Incentivized Verified User Anonymous Read full review	We are using Splunk extensively in our projects and we have recently upgraded to Splunk version 6.0 which is quite efficient and giving expected results. We keep track of updates and new features Splunk introduces periodically and try to introduce those features in our day to day activities for improvement in our reporting system and other tasks. Verified User Anonymous Read full review	No answers on this topic
Usability	The Microsoft Azure Sentinel solution is very good and even better if you use Azure. It's easy to implement and learn how to use the tool with an intuitive and simple interface. New updates are happening to always bring new news and improve the experience and usability. The solution brings reliability as it is from a very reliable manufacturer. Incentivized Flavio Pereira Analista de sistemas Read full review	Splunk usability could be a little more friendly on correlations and log analysis. not for end users, but for the tech team, sometimes is hard to find good professionals to set up integrations and new dashboards when needed. For the high-level management, it can be overwhelming to read Splunk dashboards. Incentivized Verified User Anonymous Read full review	No answers on this topic
Reliability and Availability	No answers on this topic	When properly setup and configured, Splunk is extremely reliable. Incentivized Verified User Anonymous Read full review	No answers on this topic
Support Rating	Azure Sentinel is very easy to use and configure. If you are stuck somewhere, Microsoft support is excellent in assisting and solving your issue. Incentivized Verified User Anonymous Read full review	Splunk maintains a well resourced support system that has been consistent since we purchased the product. They help out in a timely manner and provide expert level information as needed. We typically open cases online and communicate when possible via e-mail and are able to resolve most issues with that method. Incentivized Verified User Anonymous Read full review	Dealing with the McAfee support is a lottery. Sometimes you reach them and it's a really experienced engineer, but sometimes it's a person with no clue on the tool. We had few cases where our internal engineers knew more about the tool than the McAfee support. However, sometimes we get hold of some really good engineers that know the tool from inside out Incentivized Verified User Anonymous Read full review
Online Training	No answers on this topic	The online course was simple clear and described the main capabilities of the solution. There is also an initial module that can be done for free so anyone can familiarize themselves with the functionality of this solution. On the other hand, however, there could be more free online courses. Maybe even with a certificate, this would broaden the group of people who are familiar with the platform while increasing familiarity with the solution itself. Verified User Anonymous Read full review	No answers on this topic
Implementation Rating	No answers on this topic	Smooth without too many major issues. Incentivized Verified User Anonymous Read full review	No answers on this topic
Alternatives Considered	Compared to platforms such as Splunk, LogRhythm, and Devo, Microsoft Sentinel’s cloud‑native, consumption‑based pricing model and reduced infrastructure overhead tend to offer better overall cost efficiency. This is especially true for organizations already invested in the Microsoft ecosystem, where Sentinel can deliver strong capabilities with a lower total cost of ownership. Incentivized Verified User Anonymous Read full review	A lot of products have natively inside their own dashboards and or their own logging repositories. And each one is difficult to learn or they're too complex or they're not verbose in the sense that they're not easy to mine the data that you're looking for. So that could be anything from the native logging that you find in other Cisco products. It's easier to use Splunk to draw the data that you're looking for as opposed to going to the individual's products themselves to get the logs that you're looking for. Incentivized Verified User Anonymous Read full review	McAfee Enterprise Security Manager is a better option than other security software because it's both inexpensive and extremely effective. Norton and other security software boast a high price tag but don't always back it up when it comes to performance. With McAfee Enterprise Security Manager, I know I'm getting a quality product for a fair price. Incentivized Verified User Anonymous Read full review
Scalability	No answers on this topic	Splunk can scale in to the petabyte per day range which of course is awesome Rick Yetter Regional Director Read full review	No answers on this topic
Return on Investment	It's probably neutral. We see value, but it's, again, tick that kind of expense stuff. We're getting more insight and value into what is going on in that cloud workspace, but just noting the cost. So it's probably neutral. I'm not directly responsible, so the full kind of return on investment kind of cycle, that's someone else's problem. I'm like the end user. It's my team that will look at the data and look at the output of Microsoft Sentinel. So the ROI, someone else can worry about that. Incentivized Verified User Anonymous Read full review	Ease of collecting IP for blacklisting. Generation of metrics against compromised accounts based on location and time of the year. It helped in launching phishing education campaign before hitting the most vulnerable month of the year. It helped in neutralizing vulnerable word-press sites across the campus, leading to the decrease of account compromise. Incentivized Kuntal Das Security Analyst Read full review	It effectively blocks potential attacks from outside. It aids us in doing more effective root-cause analysis whenever an incident occurs, since it gives us enough details to understand what went wrong. Incentivized Brandon Macapelit, CISA IT Auditor Read full review
ScreenShots	Microsoft Sentinel Screenshots