Surpassingly really good tool and a very interactive dashboard
We are hybrid company that allow folks to work from anywhere, as for the flexibility, the security portion is becoming more exposed, this …
Microsoft SentinelFormerly Azure Sentinel
Starting at $2.46 per GB ingested
View PricingOverview
What is Microsoft Sentinel?
Microsoft Sentinel (formerly Azure Sentinel) is designed as a birds-eye view across the enterprise. It is presented as a security information and event management (SIEM) solution for proactive threat detection, investigation, and response.
Recent Reviews
How Microsoft Sentinel Differs From Its Competitors
Awards
Products that are considered exceptional by their customers based on a variety of criteria win TrustRadius awards. Learn more about the types of TrustRadius awards to make the best purchase decision. More about TrustRadius Awards
Popular Features
- Centralized event and log data collection (14)8.686%
- Correlation (14)8.484%
- Event and log normalization/management (14)8.282%
- Custom dashboards and workspaces (14)7.474%
Reviewer Pros & Cons
- Sentinel is by far the most efficient tool in supporting the highest number of solutions and products when it comes to data connection (or ingestion) ...
- 'Notebook' has always been a very hard to use feature for me in Sentinel. From my experience, there have been a very selective use cases for this feat...
Associate Lead Security Admin
Atidan (Information Technology & Services, 201-500 employees)
Pricing
Azure Sentinel
$2.46
Cloud
per GB ingested
100 GB per day
$123.00
Cloud
per day
200 GB per day
$221.40
Cloud
per day
Entry-level set up fee?
- No setup fee
For the latest information on pricing, visithttps://www.microsoft.com/en…
Offerings
- Free Trial
- Free/Freemium Version
- Premium Consulting/Integration Services
Product Demos
Microsoft Sentinel: Monitoring health and integrity of analytics rules
YouTube
Features
Return to navigation
Product Details
- About
- Competitors
- Tech Details
- FAQs
What is Microsoft Sentinel?
Microsoft Sentinel is a security operations center (SOC) solution used to uncover sophisticated threats and respond with a security information and event management (SIEM) solution for proactive threat detection, investigation, and response. It eliminates security infrastructure setup and maintenance, and elastically scales to meet the user's security needs.
Helps users to protect the digital estate: Secures the digital estate with scalable, integrated coverage for a hybrid, multicloud, multiplatform business.
Microsoft intelligence to Empower SOC: Optimizes SecOps with advanced AI, security expertise, and threat intelligence.
Detection, investigation and Response: A unified set of tools to monitor, manage, and respond to incidents.
Cost of ownership: A cloud-native SaaS solution to reduce infrastructural costs.
Microsoft Sentinel Features
Security Information and Event Management (SIEM) Features
- Supported: Centralized event and log data collection
- Supported: Correlation
- Supported: Event and log normalization/management
- Supported: Deployment flexibility
- Supported: Integration with Identity and Access Management Tools
- Supported: Custom dashboards and workspaces
- Supported: Host and network-based intrusion detection
- Supported: Log retention
- Supported: Data integration/API management
- Supported: Behavioral analytics and baselining
- Supported: Rules-based and algorithmic detection thresholds
- Supported: Response orchestration and automation
- Supported: Incident indexing/searching
Microsoft Sentinel Screenshots
Microsoft Sentinel Videos
Playlist for Microsoft Sentinel videos
Microsoft Sentinel: Monitoring health and integrity of analytics rules
Microsoft Sentinel Competitors
Microsoft Sentinel Technical Details
| Deployment Types | Software as a Service (SaaS), Cloud, or Web-Based |
|---|---|
| Operating Systems | Unspecified |
| Mobile Application | No |
Frequently Asked Questions
Microsoft Sentinel (formerly Azure Sentinel) is designed as a birds-eye view across the enterprise. It is presented as a security information and event management (SIEM) solution for proactive threat detection, investigation, and response.
Splunk Enterprise Security (ES), IBM Security QRadar SIEM, and Securonix Next-Generation SIEM are common alternatives for Microsoft Sentinel.
Reviewers rate Deployment flexibility highest, with a score of 9.2.
The most common users of Microsoft Sentinel are from Enterprises (1,001+ employees).
Comparisons
Compare with
Reviews and Ratings
(66)Attribute Ratings
Reviews
(1-14 of 14)Companies can't remove reviews or game the system. Here's why
December 06, 2023
Surpassingly really good tool and a very interactive dashboard
We are taking data from : Intune, Entra ID and Defender for Endpoint , those three are already lots enough resources t handle, especially when you have a small team that manages 200 endpoints.
As all data sources are within the Microsoft's suite, the out of the box settings are documented really well , for example with EntraID the Azure market place is providing it for us.
November 13, 2023
SIEM means Sentinel
Native Microsoft connections include Microsoft Defender for Cloud, Microsoft 365 Defender, Microsoft Entra ID, Azure Activity, Security Events, Key Vaults, SQL Databases, Windows events via AMA, Microsoft Defender Threat Intelligence etc.
Third party products include Workday, Google Workspaces, Cisco ASA, AWS S3 and CloudTrail logs, Zscaler, Carbon Black, Virus Total etc.
Third party products include Workday, Google Workspaces, Cisco ASA, AWS S3 and CloudTrail logs, Zscaler, Carbon Black, Virus Total etc.
Connecting the Microsoft native solutions are the easiest ones. While connecting Azure resources are also easy but a bit lengthy process.
Integration of third party products with Sentinel varies wildly from each other, so in a word, it's doable with a little technical overhead.
Integration of third party products with Sentinel varies wildly from each other, so in a word, it's doable with a little technical overhead.
October 27, 2023
Why you should start using Microsoft Sentinel today.
All Microsoft Cloud products Palo Alto Barracuda Fortigate Cisco Darktrace BeyondTrust Azure DevOps GitHub CheckPoint F5, etc.
For some products, this went flawless, but other connectors are more complex. Especially when working with systems like the Cisco FirePower or solutions that need to be queried through a FunctionApp makes the implementation more fragile.
October 24, 2023
Sentinel: Your one stop SIEM for cloud for Bird's Eyes by MS.
Sentinel pretty much supports logs from most of the well-known vendors. The key log sources that we have been using to pull data to Sentinel are 1. O365 and Azure logs. 2. EDR 3. IAM Stack including PAM, IAG, and SSO 4. Windows-based AD logs 5.Network Detection and Response (NDR).
An API integration built by the provider connects with the provider data sources and pushes data into Microsoft Sentinel custom log tables using the Azure Monitor Data Collector API. The process is fairly simple as long as there is troubleshooting involved for active data collection.
October 23, 2023
Microsoft Sentinel, the scaleable cloud-native SIEM platform
Cloud Identities
On-Premises Identity events
Azure platform events
Defender and other Microsoft products
On-premises appliances
Linux events
On-Premises Identity events
Azure platform events
Defender and other Microsoft products
On-premises appliances
Linux events
The native microsoft sources are pretty easy to incorporate with the standard integrated data connectors
This same counts towards Azure activity, Azure VMs and workloads
On-premises workloads will make use of logforwarders (Windows Event Forwarder / Syslog Forwarder) We are moving to Logstash in due time
This same counts towards Azure activity, Azure VMs and workloads
On-premises workloads will make use of logforwarders (Windows Event Forwarder / Syslog Forwarder) We are moving to Logstash in due time
Here are some of the primary sources from which Microsoft Sentinel can collect data:
- Microsoft 365 Services: Data from Microsoft 365 services, including Exchange Online, SharePoint, Teams, and Azure Active Directory, were ingested to monitor email, document, and user activities.
- Azure Services: Data from various Azure services, such as Azure Security Center, Azure Firewall, Azure Monitor, and Azure Active Directory, were collected to provide insights into cloud security.
- On-Premises Data Sources: Microsoft Sentinel supported the integration of on-premises security solutions, including security appliances, firewalls, Active Directory, and Windows Event Logs.
- Endpoint Protection: Data from endpoint protection solutions, like Microsoft Defender Antivirus, was collected to monitor and respond to threats on endpoints.
- Firewalls and Network Appliances: Logs and data from network security appliances and firewalls were also ingested to monitor network traffic and identify potential threats.
- Azure Data Connectors: The tool provided a variety of built-in connectors and workbooks to ingest and analyze the data from MS solutions and third party applications
October 02, 2023
Review of Microsoft Sentinel
We pull data from On-Premises Sources and also from Custom Data Sources (using API)
When setting up these connectors, the process was relatively straightforward and well-documented. Microsoft Sentinel provides a user-friendly interface within the Azure portal, making it easy to configure data sources and integrate them into our security monitoring workflow.
September 22, 2023
One stop solution for all security needs. Transforming Security with AI and Automation
We connected Microsoft Sentinel from AWS. I know that it can be connected with Azure or GCP also. Not sure about others.
September 20, 2023
A big SIEM or a little SOAR?
We gather data from different data connectors such as Firewall, Endpoints, Servers, Amazon Web Services, Hypervisors, and more. There's a comprehensive list in the official documentation that helps to assess the possible integrations that can be made when it comes to deploying the product in the infrastructure. There's a range of protocols and ways to send data to Microsoft Sentinel, from the simple Syslog to the API-based integrations.
It really depends on the connector and how it is integrated into Microsoft Sentinel. Some integrations can be easy, such as Microsoft Events Logs that can be massively deployed on every endpoint of the infrastructure. Other connectors require a little bit of configuration before they start to work as intended.
September 13, 2023
Microsoft Sentinel Review
So I think they pull from DNS, firewalls, HBSS, that's it.
September 13, 2023
Microsoft Sentinel Review
It's a Proofpoint email security then from my Palo Alto firewalls and from a graph and active directly. So all those, I can say network devices and endpoint devices, my XDR solution.
It takes little time because getting the resources in the market is quite challenging. When we started, because it was relatively new in the market, we didn't get the SMEs, Subject metrics experts, who have good hands-on experience on the defender. That's one of the aspects.
September 13, 2023
Microsoft Sentinel Review
Multiple. We have email ingest, all of the O365 stuff and our firewalls, mainly.
It wasn't that hard. It was just dropping the data and then pipelining it in, so it's not that bad.
September 13, 2023
Microsoft Sentinel Review
Obviously 65 ID sis Log, common Security log. Yeah, those are the three most common.
Good.
September 12, 2023
Microsoft Sentinel Review
Other than the Microsoft Suite, like the Defender, Azure and all these, they get fed. We got Meraki, we got Cisco Umbrella, we got Windows Locks, we got Azure Arc getting fed into Sentinel as well.