Skip to main content
TrustRadius
Microsoft Sentinel

Microsoft Sentinel
Formerly Azure Sentinel

Overview

What is Microsoft Sentinel?

Microsoft Sentinel (formerly Azure Sentinel) is designed as a birds-eye view across the enterprise. It is presented as a security information and event management (SIEM) solution for proactive threat detection, investigation, and response.

Read more
Recent Reviews

Microsoft Sentinel

8 out of 10
September 12, 2023
Incentivized
So it's a lot around the correlation of different log systems within our customer systems to give us information and threat intelligence …
Continue reading
Read all reviews

How Microsoft Sentinel Differs From Its Competitors

Sources

We are taking data from : Intune, Entra ID and Defender for Endpoint , those three are already lots enough resources t handle, especially when you have a small team that manages 200 endpoints.
As all data sources are within the Microsoft's suite, the out of the box settings are documented really …
Continue reading

AI and ML

No we are not using the AI features as there are limitations in the licenses that we bought, even without it, it has been doing a wonderful job for us so far, it will be way better with the AI features, but in the end, we only have bought so much for the licenses, hence the SaaS default is our way …
Continue reading

Investigation Tools

Fortunately, we never reached that stage for the past 2 years, our users have been quite complied with all the Do's and Don'ts that we set from very beginning and it will be a wish to never use them in the future, but looking at the documentation, it is a great process
Continue reading

AI and ML

With 'Entity Behavior' and its machine learning capabilities, we have been able to detect many risky users and other entities which saved a lot of time and effort if otherwise done manually.
While I have a very limited experience with using Azure Open AI in the incident through playbooks, it surely …
Continue reading

Investigation Tools

We have been working on establishing a process to reduce the triaging time by using of incident investigation utilities in Sentinel. For example, we have made a good use of automation rules to define which playbooks to run for many critical and/or repetitive incident categories which helps in …
Continue reading

Sources

All Microsoft Cloud products Palo Alto Barracuda Fortigate Cisco Darktrace BeyondTrust Azure DevOps GitHub CheckPoint F5, etc.
For some products, this went flawless, but other connectors are more complex. Especially when working with systems like the Cisco FirePower or solutions that need to be …
Continue reading

Investigation Tools

Microsoft Sentinel is one of the products that are being used in the investigation phases. Depending on the incident, multiple Microsoft Portals are used to retrieve the required information to investigate an incident. The mapping between resources and events is really powerful and gives a …
Continue reading

Sources

Sentinel pretty much supports logs from most of the well-known vendors. The key log sources that we have been using to pull data to Sentinel are 1. O365 and Azure logs. 2. EDR 3. IAM Stack including PAM, IAG, and SSO 4. Windows-based AD logs 5.Network Detection and Response (NDR).
An API …
Continue reading

AI and ML

Machine Learning at the core of innovation in Microsoft Sentinel. By analyzing your incidents over time and deducing patterns, Microsoft Sentinel can provide you with actionable recommendations and insights to significantly improve the quality of your detections so you can spend less time …
Continue reading

Investigation Tools

Just like other SIEM solutions, Sentinel also comes with its perks and features. The incident timeline widget by MS provides a key insight to the analyst about the major progress of the incident helping him to focus on important things. The similar incident widget again helps the analyst to …
Continue reading

Sources

Cloud Identities
On-Premises Identity events
Azure platform events
Defender and other Microsoft products
On-premises appliances
Linux events
The native microsoft sources are pretty easy to incorporate with the standard integrated data connectors
This same counts towards Azure activity, Azure VMs and …
Continue reading

AI and ML

We make use of UEBA for the correlation between anomalies, especially on the identity platform.

Next to that we use the Fusion rules that will detect multi-stage attack scenarios
Sentinel notebooks are not used a lot at this moment, because of the learning curve
Continue reading

Investigation Tools

We do not rely too much on the investigation tools. Investigation will primarily be done with investigation with KQL Queries. The investigation dashboard is looked into to identify the entities and a first overview of the timeline. After that we construct our own timeline by using our own queries
Continue reading

Sources

Here are some of the primary sources from which Microsoft Sentinel can collect data:
  1. Microsoft 365 Services: Data from Microsoft 365 services, including Exchange Online, SharePoint, Teams, and Azure Active Directory, were ingested to monitor email, document, and user activities.
  2. Azure Services: Data …
Continue reading

Investigation Tools

1. Data Query and Search: Microsoft Sentinel provided a powerful query language that allowed analysts to search and filter security data from various sources.
Impact: Analysts quickly retrieved relevant data, which resulted in reducing the time it takes to gather evidence and establish the scope of …
Continue reading

Sources

We pull data from On-Premises Sources and also from Custom Data Sources (using API)
When setting up these connectors, the process was relatively straightforward and well-documented. Microsoft Sentinel provides a user-friendly interface within the Azure portal, making it easy to configure data …
Continue reading

AI and ML

I Feel this feature gives Microsoft Sentinel an advantage from competitors. Because of this feature Microsoft Sentinel becomes more expensive than its competitor. We are yet to use this feature widely.
Continue reading

Investigation Tools

Microsoft Sentinel's investigation tools have had a positive impact on our incident investigation process. It made our investigations faster, more accurate, and more proactive, ultimately strengthening our organization's ability to detect threats effectively.
Continue reading

AI and ML

I think, this feature gives it upperhand from competitors and hence high pricing. We used: 1. Anomaly Detection : Microsoft Sentinel can generate alerts for potential anomalies. For example, it can identify unusual login patterns, data access, or network traffic. 2. Behavioural Analytics: By …
Continue reading

Investigation Tools

We can identify hazards in our environment, create incidents and triage them, monitor threats in real time, and do extensive investigations using AI functions. Cyber-attack mitigation. Information security, along with automation, is something that every organization requires right now, and …
Continue reading

Sources

We gather data from different data connectors such as Firewall, Endpoints, Servers, Amazon Web Services, Hypervisors, and more. There's a comprehensive list in the official documentation that helps to assess the possible integrations that can be made when it comes to deploying the product in the …
Continue reading

AI and ML

Threat detection in Microsoft Sentinel can be enhanced by AI and Machine Learning. It's something mainly based on the User Behaviour Analytics concept when it comes to machine learning, and it's heuristic counterpart helps to detect threats and respond to malicious behavior while correlating …
Continue reading

Investigation Tools

Microsoft Sentinel’s investigation tools really enhance the whole analysis process with its timeline bookmarks while not only correlating events just like any other SIEM but also integrating something that comes directly from the SOAR world, which means correlating incidents and highlighting …
Continue reading

Investigation Tools

The tool to look for any type of notification that anybody's trying to get into your boundary. When somebody gets a notification, they click on that notification and see what all systems were affected by the possible compromise. So being able to drill down to look at the root cause or whatever …
Continue reading

Sources

It's a Proofpoint email security then from my Palo Alto firewalls and from a graph and active directly. So all those, I can say network devices and endpoint devices, my XDR solution.
It takes little time because getting the resources in the market is quite challenging. When we started, because it …
Continue reading

Sources

Multiple. We have email ingest, all of the O365 stuff and our firewalls, mainly.
It wasn't that hard. It was just dropping the data and then pipelining it in, so it's not that bad.
Continue reading

AI and ML

Yes, we're using it right now just on the Microsoft stuff, since that's all it does. So if it were to branch out, we'd love it to do more networking and add behavioral and machine learning analytics around all of their data sources, not just Microsoft agnostic. We've successfully deployed it into …
Continue reading

Investigation Tools

They're pretty good. Their workbooks are where they really live up to a lot of their consolidation of data, so it's really good. Definitely made it a little bit easier in some questions, it's been good.
Continue reading

Sources

Other than the Microsoft Suite, like the Defender, Azure and all these, they get fed. We got Meraki, we got Cisco Umbrella, we got Windows Locks, we got Azure Arc getting fed into Sentinel as well.
Continue reading

Investigation Tools

We use it whenever there's an incident with medium and high. If we get an alert a query or something, we just look it up and see what are the lock from source destination, IP port, it's very helpful. You have everything in one place. Saved me time.
Continue reading

Awards

Products that are considered exceptional by their customers based on a variety of criteria win TrustRadius awards. Learn more about the types of TrustRadius awards to make the best purchase decision. More about TrustRadius Awards

Popular Features

View all 13 features
  • Centralized event and log data collection (14)
    8.6
    86%
  • Correlation (14)
    8.4
    84%
  • Event and log normalization/management (14)
    8.2
    82%
  • Custom dashboards and workspaces (14)
    7.4
    74%

Reviewer Pros & Cons

View all pros & cons
Return to navigation

Pricing

View all pricing

Azure Sentinel

$2.46

Cloud
per GB ingested

100 GB per day

$123.00

Cloud
per day

200 GB per day

$221.40

Cloud
per day

Entry-level set up fee?

  • No setup fee
For the latest information on pricing, visithttps://www.microsoft.com/en…

Offerings

  • Free Trial
  • Free/Freemium Version
  • Premium Consulting/Integration Services
Return to navigation

Product Demos

Microsoft Sentinel: Monitoring health and integrity of analytics rules

YouTube
Return to navigation

Features

Security Information and Event Management (SIEM)

Security Information and Event Management is a category of security software that allows security analysts to look at a more comprehensive view of security logs and events than would be possible by looking at the log files of individual, point security tools

8.4
Avg 7.8
Return to navigation

Product Details

What is Microsoft Sentinel?

Microsoft Sentinel is a security operations center (SOC) solution used to uncover sophisticated threats and respond with a security information and event management (SIEM) solution for proactive threat detection, investigation, and response. It eliminates security infrastructure setup and maintenance, and elastically scales to meet the user's security needs.

Helps users to protect the digital estate: Secures the digital estate with scalable, integrated coverage for a hybrid, multicloud, multiplatform business.

Microsoft intelligence to Empower SOC: Optimizes SecOps with advanced AI, security expertise, and threat intelligence.

Detection, investigation and Response: A unified set of tools to monitor, manage, and respond to incidents.

Cost of ownership: A cloud-native SaaS solution to reduce infrastructural costs.

Microsoft Sentinel Features

Security Information and Event Management (SIEM) Features

  • Supported: Centralized event and log data collection
  • Supported: Correlation
  • Supported: Event and log normalization/management
  • Supported: Deployment flexibility
  • Supported: Integration with Identity and Access Management Tools
  • Supported: Custom dashboards and workspaces
  • Supported: Host and network-based intrusion detection
  • Supported: Log retention
  • Supported: Data integration/API management
  • Supported: Behavioral analytics and baselining
  • Supported: Rules-based and algorithmic detection thresholds
  • Supported: Response orchestration and automation
  • Supported: Incident indexing/searching

Microsoft Sentinel Screenshots

Screenshot of Screenshot of Screenshot of Microsoft Sentinel Capabilities

Microsoft Sentinel Videos

Playlist for Microsoft Sentinel videos
Microsoft Sentinel: Monitoring health and integrity of analytics rules

Microsoft Sentinel Competitors

Microsoft Sentinel Technical Details

Deployment TypesSoftware as a Service (SaaS), Cloud, or Web-Based
Operating SystemsUnspecified
Mobile ApplicationNo

Frequently Asked Questions

Microsoft Sentinel (formerly Azure Sentinel) is designed as a birds-eye view across the enterprise. It is presented as a security information and event management (SIEM) solution for proactive threat detection, investigation, and response.

Splunk Enterprise Security (ES), IBM Security QRadar SIEM, and Securonix Next-Generation SIEM are common alternatives for Microsoft Sentinel.

Reviewers rate Deployment flexibility highest, with a score of 9.2.

The most common users of Microsoft Sentinel are from Enterprises (1,001+ employees).
Return to navigation

Comparisons

View all alternatives
Return to navigation

Reviews and Ratings

(66)

Attribute Ratings

Reviews

(1-21 of 21)
Companies can't remove reviews or game the system. Here's why
December 06, 2023

Surpassingly really good tool and a very interactive dashboard

Verified User
General Manager in Information Technology
Automotive Company, 1001-5000 employees
Score 8 out of 10
Vetted Review
Verified User
Incentivized
Likelihood to Recommend
This tool will be just awesome if all of your environments (be it OS and Applications) are in Microsoft's family, as the integration with other suite like Microsoft Sentinel, M365, Defender for end point are just clicks away, for those who are able to pay such cost, this will be something that being implemented

For those that are in mixed environment, you might have to think the YoY cost, especially as this is cloud native applications, if the application is being used to consume data, then there will be nothing to worry about, but once the data is being transport for other purposes, this is where the overall cost needs to be calculated meticulously
November 13, 2023

SIEM means Sentinel

Yash Mudaliar | TrustRadius Reviewer
Yash Mudaliar
Associate Lead Security Admin
Atidan (Information Technology & Services, 201-500 employees)
Score 9 out of 10
Vetted Review
Verified User
Incentivized
Likelihood to Recommend
Sentinel is the best "cloud-native" in the market yet, so if the organization has a cloud presence (which almost everyone has) then Sentinel is the right choice for having a single pane of glass for all your security monitoring needs.
Sentinel is a very good tool for log analysis and event management purposes as well. With KQL and ASIM parsers, organizations can retrieve invaluable insights even from the most complex data.
And of course, Sentinel is a great choice for automating the incident response process to a very good extent.
October 27, 2023

Why you should start using Microsoft Sentinel today.

Rogier Dijkman | TrustRadius Reviewer
Rogier Dijkman
Principal Consultant Cloud Security
Nedscaper (Information Technology & Services, 51-200 employees)
Score 8 out of 10
Vetted Review
Verified User
Incentivized
Likelihood to Recommend
Microsoft Sentinel is a great fit for any environment running Microsoft systems, either on-premises or cloud The integration between the Microsoft SaaS products and Sentinel is great and easy to configure. Nowadays, more and more 3rd solution providers are creating an integration with Microsoft Sentinel to easily onboard their products through the Content Hub.
October 24, 2023

Sentinel: Your one stop SIEM for cloud for Bird's Eyes by MS.

Verified User
Analyst in Information Technology
Electrical & Electronic Manufacturing Company, 5001-10,000 employees
Score 8 out of 10
Vetted Review
Verified User
Incentivized
Likelihood to Recommend
Microsoft Sentinel is an amazing choice for an organization that is already consuming multiple services from Microsoft as the most tedious task for any SIEM admin is making the tool understand the log sources and creating use cases around it. Sentinel solves this problem for a large suite of MS products as the products are well known to SIEM. Also, if the organization is using other security controls from MS, then the security fabric built is very strong for the network.
October 23, 2023

Microsoft Sentinel, the scaleable cloud-native SIEM platform

Verified User
Consultant in Information Technology
Information Technology & Services Company, 51-200 employees
Score 8 out of 10
Vetted Review
Verified User
Incentivized
Likelihood to Recommend
For most customers that have a cloud native workload that is based on Microsoft products it is an excellent product. Because of the integration it can be used pretty cost efficient and it works pretty good across the different products. This is very much the case when Azure AD/Entra is being used for authentication which will benefit with UEBA and Fusion.
When companies have no Microsoft footprint it still can be an excellent product, but it lacks integration and UEBA/Fusion have none or less additional value.
Compared with other SIEM solutions it is a very good product, but keep in mind that using Microsoft products will get you on the right track out of the box
October 19, 2023

Unleashing the Power of Data for Seamless Security Investigations

Verified User
Executive in Professional Services
Marketing & Advertising Company, 51-200 employees
Score 8 out of 10
Vetted Review
Verified User
Incentivized
Likelihood to Recommend
Microsoft Sentinel helped the cloud-first enterprise overcome the challenges associated with managing security in a complex, multi-cloud environment. It provideed the tools and capabilities needed to detect, investigate, and respond to security threats, ultimately strengthening the organization's security posture and compliance efforts.
September 22, 2023

One stop solution for all security needs. Transforming Security with AI and Automation

Namandeep Bhatia | TrustRadius Reviewer
Namandeep Bhatia
Co Founder & Chief Technology Officer
Pickright Technologies (Financial Services, 11-50 employees)
Score 7 out of 10
Vetted Review
Verified User
Incentivized
Likelihood to Recommend
As stated earlier, it might uses some sort of advanced analytics and machine learning to detect threats and anomalies in real-time. It can identify suspicious activities, potential security breaches, and other security incidents very well. So it is beneficial if you don't want to keep a team for real time threats detection. It only takes one time integration process and then good to go.
September 20, 2023

Excellent cloud security solution with intelligent analytics and automation offered by Microsoft.

Glenn H. Miller | TrustRadius Reviewer
Glenn H. Miller
Chief Engineer
Helix Energy Solutions Group (Oil & Energy, 1001-5000 employees)
Score 9 out of 10
Vetted Review
Verified User
Incentivized
Likelihood to Recommend
It is an excellent choice for a SIEM since it offers intriguing and intelligent features and functions, and it is extremely strong in terms of cloud information processing. I recommend it to my colleagues since it is simple to set up, configure, and use on a regular basis. It is ideal if you want built-in security and tracking, and it is compatible with various operating systems, but the amount of information and capabilities is limited.
September 20, 2023

A big SIEM or a little SOAR?

Verified User
Analyst in Information Technology
Information Technology & Services Company, 11-50 employees
Score 9 out of 10
Vetted Review
Verified User
Incentivized
Likelihood to Recommend
Microsoft Sentinel is a largely scalable product that can suit basically any infrastructure from the smallest to the huge international corporation (costs aside). The Microsoft infrastructure is the field of battle where Microsoft Sentinel can really express itself providing not only a great SIEM that enhances the whole security but also bringing a great tool to correct vulnerabilities and misconfigurations around the environment.
September 13, 2023

Microsoft Sentinel Review

Verified User
Employee in Information Technology
Information Technology & Services Company, 5001-10,000 employees
Score 10 out of 10
Vetted Review
Verified User
Incentivized
Likelihood to Recommend
I guess it's well suited for Security Operations Center, because its always sitting there pretty much monitoring the wire to see what type of attempts outside adversary might make to try to get into the organization. So it could be best in a security operations center. Where it wouldn't be useful is in a place where they don't have a security and focus. That's pretty much all it.
September 13, 2023

Microsoft Sentinel Review

Verified User
Consultant in Information Technology
Information Technology & Services Company, 10,001+ employees
Score 8 out of 10
Vetted Review
Verified User
Incentivized
Likelihood to Recommend
For example, if some identities are compromised, it works well where I get as I told, it gives me complete visibility of the user of the endpoint and the SaaS exposure. We can say containment time is much less if I'm using this. With the playbook I can automate everything if I have the Microsoft suite of products in, that does pretty well.
September 13, 2023

Microsoft Sentinel Review

GC
Gianni Castaldi
Security Consultant
Kustoworks (Information Technology & Services, 1-10 employees)
Score 10 out of 10
Vetted Review
Verified User
Incentivized
Likelihood to Recommend
I think it can be well suited at all environments. Just if you have really large loads of data, then there are companies who aren't using the data and you can better ingested in a DX. But for the rest, if you want to do detections or ing, then Sentinel is perfect.
September 12, 2023

Microsoft Sentinel

Verified User
Employee in Other
Information Technology & Services Company, 10,001+ employees
Score 8 out of 10
Vetted Review
ResellerIncentivized
Likelihood to Recommend
So it's well suited at the enterprise level as a service provider. It helps because we've got the scale. Where it's less suited is going to be in small business environments just because of the cost of implementation.
September 12, 2023

Microsoft Sentinel Review

Verified User
Advisor in Information Technology
Entertainment Company, 5001-10,000 employees
Score 8 out of 10
Vetted Review
Verified User
Incentivized
Likelihood to Recommend
On the Microsoft shop, it's very well suited. If you have all your environment. In Microsoft Azure, it's very well suited. If you don't have much, that's where it lacked. I think if someone does not have a Microsoft shop, I don't see the point in getting it.
July 06, 2023

Excellent solution for attack detection and raising alarms

Verified User
Engineer in Information Technology
Leisure, Travel & Tourism Company, 1001-5000 employees
Score 9 out of 10
Vetted Review
Verified User
Incentivized
Likelihood to Recommend
We are using Microsoft Sentinel in two different scenarios:
1. Network-based intrusion detection - monitoring security events on the company Edge environment (firewalls, VPN gateways) - this is easy to do with built-in content hubs that provide sets of analytics rules (unfortunately, not always), dashboards, and automation playbooks for almost all vendors
2. Host-based intrusion detection - end users desktops monitoring - here we use integration with cloud MS Defender deployment that provides all information from agents on local machines.
July 22, 2021

One of the best cloud security solutions with intelligent analytics and automation.

Flavio Pereira | TrustRadius Reviewer
Flavio Pereira
Analista de sistemas
Nestlé (Food & Beverages, 10,001+ employees)
Score 10 out of 10
Vetted Review
Verified User
Incentivized
Likelihood to Recommend
Azure Sentinel is an excellent option like SIEM. It has cool, smart features and functionality, and is quite powerful in terms of processing information in the cloud. I recommend it to colleagues because it is very easy to deploy and configure, and learn to use it on a daily basis. The panel is super intuitive and rich in details. When opening Sentinel, it is already possible to analyze the indices that happened and those that deserve further attention and treatment.
Return to navigation