Surpassingly really good tool and a very interactive dashboard
We are hybrid company that allow folks to work from anywhere, as for the flexibility, the security portion is becoming more exposed, this …
Microsoft SentinelFormerly Azure Sentinel
Starting at $2.46 per GB ingested
View PricingOverview
What is Microsoft Sentinel?
Microsoft Sentinel (formerly Azure Sentinel) is designed as a birds-eye view across the enterprise. It is presented as a security information and event management (SIEM) solution for proactive threat detection, investigation, and response.
Recent Reviews
How Microsoft Sentinel Differs From Its Competitors
Awards
Products that are considered exceptional by their customers based on a variety of criteria win TrustRadius awards. Learn more about the types of TrustRadius awards to make the best purchase decision. More about TrustRadius Awards
Popular Features
- Centralized event and log data collection (14)8.686%
- Correlation (14)8.484%
- Event and log normalization/management (14)8.282%
- Custom dashboards and workspaces (14)7.474%
Reviewer Pros & Cons
- Sentinel is by far the most efficient tool in supporting the highest number of solutions and products when it comes to data connection (or ingestion) ...
- 'Notebook' has always been a very hard to use feature for me in Sentinel. From my experience, there have been a very selective use cases for this feat...
Associate Lead Security Admin
Atidan (Information Technology & Services, 201-500 employees)
Pricing
Azure Sentinel
$2.46
Cloud
per GB ingested
100 GB per day
$123.00
Cloud
per day
200 GB per day
$221.40
Cloud
per day
Entry-level set up fee?
- No setup fee
For the latest information on pricing, visithttps://www.microsoft.com/en…
Offerings
- Free Trial
- Free/Freemium Version
- Premium Consulting/Integration Services
Product Demos
Microsoft Sentinel: Monitoring health and integrity of analytics rules
YouTube
Features
Return to navigation
Product Details
- About
- Competitors
- Tech Details
- FAQs
What is Microsoft Sentinel?
Microsoft Sentinel is a security operations center (SOC) solution used to uncover sophisticated threats and respond with a security information and event management (SIEM) solution for proactive threat detection, investigation, and response. It eliminates security infrastructure setup and maintenance, and elastically scales to meet the user's security needs.
Helps users to protect the digital estate: Secures the digital estate with scalable, integrated coverage for a hybrid, multicloud, multiplatform business.
Microsoft intelligence to Empower SOC: Optimizes SecOps with advanced AI, security expertise, and threat intelligence.
Detection, investigation and Response: A unified set of tools to monitor, manage, and respond to incidents.
Cost of ownership: A cloud-native SaaS solution to reduce infrastructural costs.
Microsoft Sentinel Features
Security Information and Event Management (SIEM) Features
- Supported: Centralized event and log data collection
- Supported: Correlation
- Supported: Event and log normalization/management
- Supported: Deployment flexibility
- Supported: Integration with Identity and Access Management Tools
- Supported: Custom dashboards and workspaces
- Supported: Host and network-based intrusion detection
- Supported: Log retention
- Supported: Data integration/API management
- Supported: Behavioral analytics and baselining
- Supported: Rules-based and algorithmic detection thresholds
- Supported: Response orchestration and automation
- Supported: Incident indexing/searching
Microsoft Sentinel Screenshots
Microsoft Sentinel Videos
Playlist for Microsoft Sentinel videos
Microsoft Sentinel: Monitoring health and integrity of analytics rules
Microsoft Sentinel Competitors
Microsoft Sentinel Technical Details
| Deployment Types | Software as a Service (SaaS), Cloud, or Web-Based |
|---|---|
| Operating Systems | Unspecified |
| Mobile Application | No |
Frequently Asked Questions
Microsoft Sentinel (formerly Azure Sentinel) is designed as a birds-eye view across the enterprise. It is presented as a security information and event management (SIEM) solution for proactive threat detection, investigation, and response.
Splunk Enterprise Security (ES), IBM Security QRadar SIEM, and Securonix Next-Generation SIEM are common alternatives for Microsoft Sentinel.
Reviewers rate Deployment flexibility highest, with a score of 9.2.
The most common users of Microsoft Sentinel are from Enterprises (1,001+ employees).
Comparisons
Compare with
Reviews and Ratings
(67)Attribute Ratings
Reviews
(1-21 of 21)Companies can't remove reviews or game the system. Here's why
December 06, 2023
Surpassingly really good tool and a very interactive dashboard
- Integration with intune is out of the box
- Integration with Microsoft Defender for End Point
- As we don't use the egress data, but this could be a very expensive cloud cost for other organization out there
- The popularity is increasing but you might be ending up in vendor lock down
November 13, 2023
SIEM means Sentinel
- Sentinel is by far the most efficient tool in supporting the highest number of solutions and products when it comes to data connection (or ingestion) and that too in the least complex manner possible. Most of the data connectors in Sentinel are very easy to configure and deploy.
- Incident Management is undoubtedly one of the main USPs of Sentinel. With an easy-to-use UI, variety of utilities (adding tasks, manual triggering of playbooks, activity logs etc.) and provision of having an investigation map from the incident details page, Sentinel clearly stands out in this area.
- I personally love the feature of integrating 'Threat Intelligence' to Sentinel from a free and one of the most reliable sources, Microsoft itself. This not only saves time for an analyst in checking the reputation of an entity but also allows to take actions on the suspicious entities at earliest.
- 'Notebook' has always been a very hard to use feature for me in Sentinel. From my experience, there have been a very selective use cases for this feature across the industry.
- 'Entity Behavior' has some scope to be improved further since it is a feature that gives some useful insights but needs to be accessed separately. I think it should be re-worked in a way to be used within the incident investigation page.
- I'd like to see a more user-friendly version of the 'Content Hub' menu which was the earlier version! The new UI is somewhat confusing to use and is dependent on a lot of filters being applied which do not even lasts for a single session. With each refresh, we have to apply the filters again.
October 27, 2023
Why you should start using Microsoft Sentinel today.
- Correlating Security Data.
- Automated response.
- Threat Intelligence mapping.
- Performance on data ingestion.
- Performance on query data.
- Normalizing data.
October 24, 2023
Sentinel: Your one stop SIEM for cloud for Bird's Eyes by MS.
- Parsing and Normalization of cloud-based log sources provided by Microsoft
- Cheaper license cost compared to the traditional SIEMs.
- Interactive UI.
- Searching for logs is a little tedious due to scripting commands.
- Creating use cases can be a little bit more friendly.
- Non-Microsoft product pairing can be made a little easier.
October 23, 2023
Microsoft Sentinel, the scaleable cloud-native SIEM platform
- It has a native integration with all Microsoft products, from Entra to Azure, Microsoft 365
- Being built upon native Azure functionality benefits in automation and infrastructual solutions
- The KQL language is relatively easy to learn and powerful.
- Microsoft is listening very careful to the customers and develops new functionality at a fast pace
- The solution can become very expensive when not used in an effective way
- The SOAR functionality can be more powerful compared to other products
- Ingestions delays are not often clear and have to be taken care of thoroughly
- Enhanced Threat Visibility: Centralized data collection provided a comprehensive view of security events and incidents across their entire environment, improving threat visibility.
- Rapid Threat Detection and Response: The platform's analytics and automation capabilities enabled the organization to detect and respond to threats more quickly and effectively, reduced the impact of security incidents.
- Improved Compliance: Azure Sentinel's reporting and compliance features assisted the organization in meeting industry-specific compliance requirements, also reduced the risk of regulatory fines and legal consequences.
- Compelxity of the tool's query language
- Unnecessary alerts and false positives
- Rare issues with data ingestion
October 02, 2023
Review of Microsoft Sentinel
- Threat Detection and faster Analysis
- Security Automation and architecture improvement
- Onboarding and integration with client/our system can be simplified so that it can be used by everyone.
- Integration takes longer if software is hosted outside.
- The logs of softwares hosted in-house has room for improvement
September 22, 2023
One stop solution for all security needs. Transforming Security with AI and Automation
- Detection of cyber threts, malware, and suspicious activities etc. across whole IT environment.
- Streamlining the process of identifying and responding to security incidents, minimizing their impact
- Real-time monitoring
- Price is on higher side as compared to competitive products
- Process of Onboarding and connecting with system can be simplified
- If software is hosted anywhere else from Azure then integration is bit time taking.
- Difficult to work with KQL. Enhanced support for more standard query languages, like SQL, could be beneficial.
September 20, 2023
Excellent cloud security solution with intelligent analytics and automation offered by Microsoft.
- It interacts easily with Azure, Active Directory, and log analytics, and it can route data via Sentinel as well as establish alerts and other workflows to respond to possible security concerns.
- It features a highly user-friendly UI that makes it simple to operate the platform, and the kql is simple to use while studying logs.
- It is one of the greatest platforms for totally cloud deployment, which improves productivity. It can evaluate vast amounts of data quickly and is incredibly productive.
- It takes some time to learn how to use and install it properly, and it does not connect effectively with external PaaS systems such as Salesforce CRM, Salesforce Commerce Cloud, and so on.
- Microsoft can simplify the display of the logs to make them easier to study, and the user interface occasionally delays, which can also be enhanced.
September 20, 2023
A big SIEM or a little SOAR?
- KQL Query language is easy to learn and very powerful once mastered.
- A continuously growing list of connectors allows the integration of hundreds of technologies.
- Microsoft Sentinel provides the best integrations with Microsoft's products.
- Like many Microsoft products, the solution can lose its effectiveness in non-Microsoft environments.
- It's not the most cost-effective solution out there.
- False positives are something that really needs to be addressed when confronting Microsoft Sentinel.
September 13, 2023
Microsoft Sentinel Review
- It's pretty good. We're working with other Microsoft products for sure. If you got Outlook 365, it worked really well with that. You had the whole Microsoft Suite, if you got a property tuned up, it does pretty good at catching things. It's very intuitive. It's very quick at being able to quarantine assets that might've been compromised in a quick manner without having to go through a whole bunch of red tape and try to find a whole bunch of people or admins to be able to help you do your job or whatnot.
- Making it able to talk with other tools outside of Microsoft would be something that would work really well with it. I know a lot of organizations utilize Splunk and it seems like trying to get the Microsoft product top to Splunk is always a big issue, especially with the Sentinel, the 365 defender, and stuff like that. So having it be able to be able to speak to other vendors' tools would definitely help out because nobody wants to just use one tool suite because one tool suite might miss one thing, then another one might pick up. They all talk to each other and they are all able to be automated would definitely be a big help any security-positive organization.
September 13, 2023
Microsoft Sentinel Review
- It's good in form of the integration with the Microsoft native products like Defender or Office 365 and some of the queue, the complete visibility because if we are using the Microsoft product suite as the operating system on the endpoint and the Microsoft Defender and those things, so its is a complete end to end visibility, not just for as a sim but complete visibility of our identity. We are also having Azure ready. It gives more visibility, the users, the endpoint, and my SaaS services like the teams or I can say Outlook. I get a good visibility and the next good thing is I can mitigate the threat in real time. I can write the playbook and I can do the hunting. One of the good things Defender, I see the hunting in the playbooks. So my form analyst where from one place where I could do the monitoring, triage response, and mitigation.
- Some of the integration though it provides integration to most of the technologies, but I still think it is a scope of integration, scope for implementing the integration area so that I can integrate all the design sources to the central. Right now I experienced some challenges with my team with that.
September 13, 2023
Microsoft Sentinel Review
- It really does do a very good job of collecting end user data or end user and device data to correlate against.
- Their UEBA really needs to grow out of the Microsoft space.
- I think they need to be a little bit more friendly using their workbooks, so that's probably where I see it should grow.
September 13, 2023
Microsoft Sentinel Review
- It handles a lot of data. It works fast, it's easy to understand. It's the integrations with all the products, the APIs defender with Office 365 with Azure ad. It's got some great integrations.
- I think that the handling of ingestion delays and time generated, I think that's currently the main issue because you get some data that comes in later, and some data comes way later, so you have to correlate it and it can be a bit of a hassle to make sure to align the right data with each other.
September 12, 2023
Microsoft Sentinel
- Ability to correlate data in near real-time and then provide that to our SOC team to then take that information and verify whether or not there's an actual active threat within the organization or a customer's organizations. So that's something that does particularly well.
- I think some of it is just around the clarity of the information. Sometimes it's not super specific, so having the ability to get more information from the links provided I think would help.
September 12, 2023
Microsoft Sentinel Review
- Getting incidents from other applications like Cisco, Meraki, or Umbrella and then ingesting the logs, creating the incident and notification of course, like playbooks.
- Data connectors, for example, Cisco Umbrella. It's either grab all the logs or nothing. We just want to grab certain logs from Umbrella. We can't do it. We have to do a custom data connector. It's just a lot of work for customers.
September 12, 2023
Microsoft Sentinel Review
- I think what it does the best is the community aspect of it which means it's already integrated in the platform. You can just click and select stuff you like and it is created by other professionals. I think that's what it does the best and it's really easy to integrate into your existing interment.
- I think it has room for improvement in its ease of use. It's not hard to use, but for someone who doesn't even add someone that shows you everything, at first it could be hard because you don't know what some of the names are. If you don't know it, you could get confused like a playbook. If you don't know what the playbook is, you could be mistaken.
- Advanced analytics and machine learning algorithms
- Easy to deploy, manage, and update
- Huge list of out-of-the-box dashboards, reports and automation playbooks
- Query language is quite difficult
- Automation playbooks some times have false positives alerts/responses
August 16, 2021
Sentinel Has Come A Long Way
- Automated detection and response
- Detailed user/device information
- Part of the MS cloudsphere, so has a familiar feel.
- In the WFH world sometimes it would be nice to have a local client version when speed isn't the best from home
- The ability to alert on a mobile device
- A mobile app to do an investigation while on the move
- Easy to deploy and learn to use.
- Artificial intelligence.
- Analysis of any type of threat, including those that have not yet been discovered.
- Automation to respond to security incidents.
- Reduction of false positives.
- Easy to edit log analysis rules.
- The reporting feature can be improved. I sometimes see problems with exportation, instability and compatibility.
- Dependence on Microsoft Azure software.
- The UI-based analytics are excellent
- Excellent tools for cleaning data, sorting out irrelevant log data, and even fixing log data.
- There's not much that needs improvement, but the on-prem log sources still require a lot of development.