Surpassingly really good tool and a very interactive dashboard
We are hybrid company that allow folks to work from anywhere, as for the flexibility, the security portion is becoming more exposed, this …
Microsoft SentinelFormerly Azure Sentinel
Starting at $2.46 per GB ingested
View PricingOverview
What is Microsoft Sentinel?
Microsoft Sentinel (formerly Azure Sentinel) is designed as a birds-eye view across the enterprise. It is presented as a security information and event management (SIEM) solution for proactive threat detection, investigation, and response.
Recent Reviews
How Microsoft Sentinel Differs From Its Competitors
Awards
Products that are considered exceptional by their customers based on a variety of criteria win TrustRadius awards. Learn more about the types of TrustRadius awards to make the best purchase decision. More about TrustRadius Awards
Popular Features
- Centralized event and log data collection (14)8.686%
- Correlation (14)8.484%
- Event and log normalization/management (14)8.282%
- Custom dashboards and workspaces (14)7.474%
Reviewer Pros & Cons
- Sentinel is by far the most efficient tool in supporting the highest number of solutions and products when it comes to data connection (or ingestion) ...
- 'Notebook' has always been a very hard to use feature for me in Sentinel. From my experience, there have been a very selective use cases for this feat...
Associate Lead Security Admin
Atidan (Information Technology & Services, 201-500 employees)
Pricing
Azure Sentinel
$2.46
Cloud
per GB ingested
100 GB per day
$123.00
Cloud
per day
200 GB per day
$221.40
Cloud
per day
Entry-level set up fee?
- No setup fee
For the latest information on pricing, visithttps://www.microsoft.com/en…
Offerings
- Free Trial
- Free/Freemium Version
- Premium Consulting/Integration Services
Product Demos
Microsoft Sentinel: Monitoring health and integrity of analytics rules
YouTube
Features
Return to navigation
Product Details
- About
- Competitors
- Tech Details
- FAQs
What is Microsoft Sentinel?
Microsoft Sentinel is a security operations center (SOC) solution used to uncover sophisticated threats and respond with a security information and event management (SIEM) solution for proactive threat detection, investigation, and response. It eliminates security infrastructure setup and maintenance, and elastically scales to meet the user's security needs.
Helps users to protect the digital estate: Secures the digital estate with scalable, integrated coverage for a hybrid, multicloud, multiplatform business.
Microsoft intelligence to Empower SOC: Optimizes SecOps with advanced AI, security expertise, and threat intelligence.
Detection, investigation and Response: A unified set of tools to monitor, manage, and respond to incidents.
Cost of ownership: A cloud-native SaaS solution to reduce infrastructural costs.
Microsoft Sentinel Features
Security Information and Event Management (SIEM) Features
- Supported: Centralized event and log data collection
- Supported: Correlation
- Supported: Event and log normalization/management
- Supported: Deployment flexibility
- Supported: Integration with Identity and Access Management Tools
- Supported: Custom dashboards and workspaces
- Supported: Host and network-based intrusion detection
- Supported: Log retention
- Supported: Data integration/API management
- Supported: Behavioral analytics and baselining
- Supported: Rules-based and algorithmic detection thresholds
- Supported: Response orchestration and automation
- Supported: Incident indexing/searching
Microsoft Sentinel Screenshots
Microsoft Sentinel Videos
Playlist for Microsoft Sentinel videos
Microsoft Sentinel: Monitoring health and integrity of analytics rules
Microsoft Sentinel Competitors
Microsoft Sentinel Technical Details
| Deployment Types | Software as a Service (SaaS), Cloud, or Web-Based |
|---|---|
| Operating Systems | Unspecified |
| Mobile Application | No |
Frequently Asked Questions
Microsoft Sentinel (formerly Azure Sentinel) is designed as a birds-eye view across the enterprise. It is presented as a security information and event management (SIEM) solution for proactive threat detection, investigation, and response.
Splunk Enterprise Security (ES), IBM Security QRadar SIEM, and Securonix Next-Generation SIEM are common alternatives for Microsoft Sentinel.
Reviewers rate Deployment flexibility highest, with a score of 9.2.
The most common users of Microsoft Sentinel are from Enterprises (1,001+ employees).
Comparisons
Compare with
Reviews and Ratings
(66)Attribute Ratings
Reviews
(1-11 of 11)Companies can't remove reviews or game the system. Here's why
November 13, 2023
SIEM means Sentinel
Microsoft Sentinel is being used as the hero product in our MSSP offerings. Our clients use it as a cloud native SIEM (Security Information and Event Management) and SOAR (Security Orchestration and Automated Response) tool. While the mains use case still remains as 'Incident Management', some of our clients also use it as an event management tool to derive actionable insights from the logs ingested.
- Sentinel is by far the most efficient tool in supporting the highest number of solutions and products when it comes to data connection (or ingestion) and that too in the least complex manner possible. Most of the data connectors in Sentinel are very easy to configure and deploy.
- Incident Management is undoubtedly one of the main USPs of Sentinel. With an easy-to-use UI, variety of utilities (adding tasks, manual triggering of playbooks, activity logs etc.) and provision of having an investigation map from the incident details page, Sentinel clearly stands out in this area.
- I personally love the feature of integrating 'Threat Intelligence' to Sentinel from a free and one of the most reliable sources, Microsoft itself. This not only saves time for an analyst in checking the reputation of an entity but also allows to take actions on the suspicious entities at earliest.
- 'Notebook' has always been a very hard to use feature for me in Sentinel. From my experience, there have been a very selective use cases for this feature across the industry.
- 'Entity Behavior' has some scope to be improved further since it is a feature that gives some useful insights but needs to be accessed separately. I think it should be re-worked in a way to be used within the incident investigation page.
- I'd like to see a more user-friendly version of the 'Content Hub' menu which was the earlier version! The new UI is somewhat confusing to use and is dependent on a lot of filters being applied which do not even lasts for a single session. With each refresh, we have to apply the filters again.
October 27, 2023
Why you should start using Microsoft Sentinel today.
We are using Microsoft Sentinel as our main SIEM solution at Nedscaper for managing out customers that are onboarded to our MXDR service. The main challenge is distributing analytics rules, playbooks, watchlists, and other artifacts at scale without implementing complex deployment pipelines in either GitHub or Azure DevOps. There are several options available, like Azure Lighthouse or using the Microsoft Sentinel Workspace Manager (Preview). Both have their pros and cons on both authentication levels, as scalability and support in artifacts that can be synchronized.
- Correlating Security Data.
- Automated response.
- Threat Intelligence mapping.
- Performance on data ingestion.
- Performance on query data.
- Normalizing data.
October 23, 2023
Microsoft Sentinel, the scaleable cloud-native SIEM platform
Sentinel is our SIEM solution that is used in our MSSP service where it is used to monitor security incidents for our customers. The integration and native support for all Microsoft products is really beneficial and helps customers with a quick onboarding. It is being used to monitor both cloud as on-premises workloads where different streams of logs are being ingested in the portal. The solution helps to centrally manage all Sentinel instances of customers where standardized solution can be distributed to the customers.
- It has a native integration with all Microsoft products, from Entra to Azure, Microsoft 365
- Being built upon native Azure functionality benefits in automation and infrastructual solutions
- The KQL language is relatively easy to learn and powerful.
- Microsoft is listening very careful to the customers and develops new functionality at a fast pace
- The solution can become very expensive when not used in an effective way
- The SOAR functionality can be more powerful compared to other products
- Ingestions delays are not often clear and have to be taken care of thoroughly
October 02, 2023
Review of Microsoft Sentinel
Microsoft Sentinel is currently being used as our one stop where our team monitors all alerts we get on our Azure resources. Since everything is on a single platform it makes it easier to keep a track and prioritise on the alerts.
- Threat Detection and faster Analysis
- Security Automation and architecture improvement
- Onboarding and integration with client/our system can be simplified so that it can be used by everyone.
- Integration takes longer if software is hosted outside.
- The logs of softwares hosted in-house has room for improvement
September 20, 2023
Excellent cloud security solution with intelligent analytics and automation offered by Microsoft.
It enables us to route security information through a tool and set up alerts to respond to possible concerns; it also connects with analytical tools to track trends, among other things. Provides real-time warnings and threat detection so that the security team can work on occurrences as rapidly as possible. Logs are easy to search and analyze, allowing for quick judgments on key security issues. It supports all sorts of log sources, allowing you to manage all endpoints on a single platform and save a lot of time when dealing with major occurrences so that remedial measures can be made quickly.
- It interacts easily with Azure, Active Directory, and log analytics, and it can route data via Sentinel as well as establish alerts and other workflows to respond to possible security concerns.
- It features a highly user-friendly UI that makes it simple to operate the platform, and the kql is simple to use while studying logs.
- It is one of the greatest platforms for totally cloud deployment, which improves productivity. It can evaluate vast amounts of data quickly and is incredibly productive.
- It takes some time to learn how to use and install it properly, and it does not connect effectively with external PaaS systems such as Salesforce CRM, Salesforce Commerce Cloud, and so on.
- Microsoft can simplify the display of the logs to make them easier to study, and the user interface occasionally delays, which can also be enhanced.
September 20, 2023
A big SIEM or a little SOAR?
Microsoft Sentinel is the SIEM (Security Information and Event Management), according to Microsoft. Entirely cloud-based, Microsoft Sentinel requires little to no effort in terms of on-premise hosting requirements. Very user-friendly and very powerful, Microsoft Sentinel takes an important step from a "simple" SIEM to a SOAR, integrating both SIEM and XDR functionalities in a cloud-based product that is covered by the Microsoft Azure cloud power.
- KQL Query language is easy to learn and very powerful once mastered.
- A continuously growing list of connectors allows the integration of hundreds of technologies.
- Microsoft Sentinel provides the best integrations with Microsoft's products.
- Like many Microsoft products, the solution can lose its effectiveness in non-Microsoft environments.
- It's not the most cost-effective solution out there.
- False positives are something that really needs to be addressed when confronting Microsoft Sentinel.
September 13, 2023
Microsoft Sentinel Review
We use a centralized sim where we collect all the logs from our Microsoft SaaS products and from our environment network and endpoint. We also use Microsoft Defender 365 and Microsoft Defender Endpoint Security. Through the center we monitor the environment, and we have the rules in, so our security analyst watches the dashboard, and based on the alerts we built FI and incident response from the defender console, Sentinel console.
- It's good in form of the integration with the Microsoft native products like Defender or Office 365 and some of the queue, the complete visibility because if we are using the Microsoft product suite as the operating system on the endpoint and the Microsoft Defender and those things, so its is a complete end to end visibility, not just for as a sim but complete visibility of our identity. We are also having Azure ready. It gives more visibility, the users, the endpoint, and my SaaS services like the teams or I can say Outlook. I get a good visibility and the next good thing is I can mitigate the threat in real time. I can write the playbook and I can do the hunting. One of the good things Defender, I see the hunting in the playbooks. So my form analyst where from one place where I could do the monitoring, triage response, and mitigation.
- Some of the integration though it provides integration to most of the technologies, but I still think it is a scope of integration, scope for implementing the integration area so that I can integrate all the design sources to the central. Right now I experienced some challenges with my team with that.
September 13, 2023
Microsoft Sentinel Review
Well, it's our SIEM, so it does all our correlation engines and data gathering, and we do a lot of querying in it.
- It really does do a very good job of collecting end user data or end user and device data to correlate against.
- Their UEBA really needs to grow out of the Microsoft space.
- I think they need to be a little bit more friendly using their workbooks, so that's probably where I see it should grow.
September 13, 2023
Microsoft Sentinel Review
I use it to test detections, create detections, make alerts, help other customers use it, ingest data, create alerts, create automation. Almost all the possibilities I use to help myself and other companies.
- It handles a lot of data. It works fast, it's easy to understand. It's the integrations with all the products, the APIs defender with Office 365 with Azure ad. It's got some great integrations.
- I think that the handling of ingestion delays and time generated, I think that's currently the main issue because you get some data that comes in later, and some data comes way later, so you have to correlate it and it can be a bit of a hassle to make sure to align the right data with each other.
Microsoft Sentinel is a cloud-based comprehensive and robust SIEM (Security information and event management) that is used for a variety of company FW/VPN infrastructure security events tracking as well as end-user protection monitoring (it is easily connected to MS Defender). The huge list of built-in connectors for different solutions/hardware eliminates any deployment issues that we had with previous SIEM system deployments. With Microsoft Sentinel, we are able to centralize all the security operations at a single point.
- Advanced analytics and machine learning algorithms
- Easy to deploy, manage, and update
- Huge list of out-of-the-box dashboards, reports and automation playbooks
- Query language is quite difficult
- Automation playbooks some times have false positives alerts/responses
Azure Sentinel has been used by our headquarters as a SIEM solution. Easy to learn, set up and use. Because it is highly scalable and cloud based, it has become ideal for managing events and providing security automation by creating automated SOAR responses to different levels of incidents, from undiscovered, simple to more complex. It has collaborated a lot in making business decisions and providing more security for the team and the organization.
- Easy to deploy and learn to use.
- Artificial intelligence.
- Analysis of any type of threat, including those that have not yet been discovered.
- Automation to respond to security incidents.
- Reduction of false positives.
- Easy to edit log analysis rules.
- The reporting feature can be improved. I sometimes see problems with exportation, instability and compatibility.
- Dependence on Microsoft Azure software.