Microsoft Sentinel

Score8.6 out of 10

179 Reviews and Ratings

What is Microsoft Sentinel?

Microsoft Sentinel (formerly Azure Sentinel) is designed as a birds-eye view across the enterprise. It is presented as a security information and event management (SIEM) solution for proactive threat detection, investigation, and response.

Categories & Use Cases

Media

Screenshot of Microsoft Sentinel Capabilities

1 / 3

Centralized event and log data collection
Effectiveness of real-time centralized event and log data collection
Category average: 8.9
Behavioral analytics and baselining
How effectively activity and behavior baselines are established and maintained
Category average: 8.6
Correlation
Correlation of logs and events to pinpoint significant threats
Category average: 8.4

Response orchestration and automation
Quality of built-in response orchestration and automation in Next-Gen SIEM
Category average: 8.4
Host and network-based intrusion detection
Ability to detect both endpoint intrusion and network ingress detection
Category average: 8.3
Reporting and compliance management
Ease and quality of reporting and compliance functions
Category average: 8.5

Most Frequent Users

Top 3 industries using Microsoft Sentinel.

Based on HG Insights installation data

View all Reviews

#1 most frequent

Professional, Scientific, and Technical Services

23.0%

2,289 installations of 9,940

“Instead of make a forensic analysis by yourself, you could use the tool.”
— Sales Representative, White Hat Consultores

#2 most frequent

Finance and Insurance

10.0%

991 installations of 9,940

#3 most frequent

Manufacturing

9.5%

942 installations of 9,940

Pros

Seamless integration with Microsoft ecosystem (Defender, M365, Azure)
Advanced AI/ML for threat detection, hunting, and automated responses
Centralized security data for comprehensive visibility across diverse environments

Cons

High and unpredictable costs due to consumption-based pricing for log storage
Limitations in out-of-the-box integrations for non-Microsoft ecosystems
Steep learning curve for Kusto Query Language (KQL)

Andrew Stowell View profile

Data Engineer in Professional Services at 3Pillar Global (1001-5000 employees)

Use Cases and Deployment Scope

Microsoft Sentinel provides efficient centralised visibility across Cloud and hybrid environments which makes security monitoring and incident investigation more reliable. It allows me to fully see logs and security alerts under one dashboard which saves time and speeds up investigations. The built-in analytics and detection systems are highly customizable which enhance seamless data handling.

Pros

Centralised visibility of security incident.
Efficient security monitoring.

Cons

The main challenge is the cost management which can be easily reduced based on the logs.

Return on Investment

Positive reporting from security incident monitoring has contributed to Positive ROI.

Usability

Other Software Used

HubSpot Marketing Hub, Atlassian Jira, Chorus by ZoomInfo

Vesa Jordan View profile

CTO at Finnfund in Information Technology at Finnfund (51-200 employees)

Use Cases and Deployment Scope

We use the Sentinel product to collect log data from our systems. This gives us a clear overview of all events and changes occurring within our technical environment. In addition, Sentinel detects security threats, which are automatically forwarded to the security operations center for further analysis. This enables us to effectively safeguard the continuity of our business operations.

Pros

Log data collection.
Integrates seamlessly with the Azure environment.
Anomaly detection.

Cons

Integration to non Azure environment solutions should be easier.
SAAS solution reporting.
The user interface could be clearer and more visual.

Return on Investment

Savings equivalent to one person-year.
Automated alarms.
Good analysis tools.

Usability

Alternatives Considered

Darktrace

Other Software Used

Darktrace, Microsoft Defender for Endpoint

Lilian Hyal

IT Admin in Information Technology at Cybele Systems (11-50 employees)

Use Cases and Deployment Scope

We use Microsoft Sentinel to boost our cybersecurity. It is our primary SIEM and SOAR solution, and it's reliable for detecting, investigating, responding to, and remediating cyber threats across our multi-cloud environments. It has greatly increased our security operations by effectively reducing false positives and centralizing security logs.

Pros

AI powered threat detection increases accuracy.
It automatically responds to threat incidences.
Proactive threat hunting adds a layer of security.
Comes with great threat intelligence features.
Makes monitoring and visualization easy.

Cons

We have experienced improper tiering.
Limited integration with non Microsoft ecosystems.

Return on Investment

Proactive threat hunting is very helpful.
Ability to auto responds to threats keeps our infrastructure secure.
Threat intelligence helps deal with known and unknown threats.

Usability

Other Software Used

Microsoft Defender for Business, Microsoft Defender XDR, Hornetsecurity Email Encryption

Sumer Tiwari

IT Director for Security in Information Technology at JBS USA (10,001+ employees)

Use Cases and Deployment Scope

We use Microsoft Sentinel as our primary SIM. We have many cloud applications that generate a lot of logs. We ingest all of those in Microsoft Sentinel. From there, we use other technologies to alert us.

Pros

Microsoft Sentinel integrates really well with SAP Rise, which is our ERP solution.

Cons

I would like to see some alerting options right in Microsoft Sentinel. For example, we have to use applications like PagerDuty and whatnot to then alert us on our cell phones. I wish Microsoft Sentinel would have that out of the box.

Return on Investment

It's really hard to justify ROI on anything security-related. You don't know what it has prevented or helped you with. So that's a very hard question to answer because you can't really quantify a number. But I hope it has stopped things from going bad.

Usability

Verified User

Engineer in Information Technology (10,001+ employees)

Use Cases and Deployment Scope

Currently, while working with a bank-based application, our team is using Microsoft Sentinel to monitor transactions, banking applications, and payment gateways for unusual user logins and to detect suspicious behavior on the platform. We also use centralized logs for generating compliance reports.It easily integrates with other Microsoft cloud platforms.

Pros

Cloud scalability allows automatic scaling. Also, KQL helps with flexible querying for detection.
Easily integrates with Microsoft systems like Microsoft azure, Microsoft 365, and other.
Provides a built in analytical templates having detection rules and saves setup time.

Cons

Pricing model is little bit complex since it is hard to know the cost in advance.
KQL learning is required initially.
Some rules generates false positive reports.

Return on Investment

It reduced the response time, resulting in a roughly 35% reduction in the average time to detect suspicious activity.
Cost has increased by 2.3% but matches the worth.
Centralized logging made the compliance audit faster since we could pull evidence from one place instead of chasing multiple systems.

Usability

Alternatives Considered

Splunk Cloud Platform and Splunk Enterprise

Other Software Used

Splunk Cloud Platform

IBM Security QRadar SIEM

Securonix Next-Generation SIEM

Splunk Enterprise Security

Microsoft Sentinel

What is Microsoft Sentinel?

Categories & Use Cases

Media