Skip to main content
TrustRadius
Microsoft Sentinel

Microsoft Sentinel
Formerly Azure Sentinel

Overview

What is Microsoft Sentinel?

Microsoft Sentinel (formerly Azure Sentinel) is designed as a birds-eye view across the enterprise. It is presented as a security information and event management (SIEM) solution for proactive threat detection, investigation, and response.

Read more
Recent Reviews

Microsoft Sentinel

8 out of 10
September 12, 2023
Incentivized
So it's a lot around the correlation of different log systems within our customer systems to give us information and threat intelligence …
Continue reading
Read all reviews

How Microsoft Sentinel Differs From Its Competitors

Sources

We are taking data from : Intune, Entra ID and Defender for Endpoint , those three are already lots enough resources t handle, especially when you have a small team that manages 200 endpoints.
As all data sources are within the Microsoft's suite, the out of the box settings are documented really …
Continue reading

AI and ML

No we are not using the AI features as there are limitations in the licenses that we bought, even without it, it has been doing a wonderful job for us so far, it will be way better with the AI features, but in the end, we only have bought so much for the licenses, hence the SaaS default is our way …
Continue reading

Investigation Tools

Fortunately, we never reached that stage for the past 2 years, our users have been quite complied with all the Do's and Don'ts that we set from very beginning and it will be a wish to never use them in the future, but looking at the documentation, it is a great process
Continue reading

AI and ML

With 'Entity Behavior' and its machine learning capabilities, we have been able to detect many risky users and other entities which saved a lot of time and effort if otherwise done manually.
While I have a very limited experience with using Azure Open AI in the incident through playbooks, it surely …
Continue reading

Investigation Tools

We have been working on establishing a process to reduce the triaging time by using of incident investigation utilities in Sentinel. For example, we have made a good use of automation rules to define which playbooks to run for many critical and/or repetitive incident categories which helps in …
Continue reading

Sources

All Microsoft Cloud products Palo Alto Barracuda Fortigate Cisco Darktrace BeyondTrust Azure DevOps GitHub CheckPoint F5, etc.
For some products, this went flawless, but other connectors are more complex. Especially when working with systems like the Cisco FirePower or solutions that need to be …
Continue reading

Investigation Tools

Microsoft Sentinel is one of the products that are being used in the investigation phases. Depending on the incident, multiple Microsoft Portals are used to retrieve the required information to investigate an incident. The mapping between resources and events is really powerful and gives a …
Continue reading

Sources

Sentinel pretty much supports logs from most of the well-known vendors. The key log sources that we have been using to pull data to Sentinel are 1. O365 and Azure logs. 2. EDR 3. IAM Stack including PAM, IAG, and SSO 4. Windows-based AD logs 5.Network Detection and Response (NDR).
An API …
Continue reading

AI and ML

Machine Learning at the core of innovation in Microsoft Sentinel. By analyzing your incidents over time and deducing patterns, Microsoft Sentinel can provide you with actionable recommendations and insights to significantly improve the quality of your detections so you can spend less time …
Continue reading

Investigation Tools

Just like other SIEM solutions, Sentinel also comes with its perks and features. The incident timeline widget by MS provides a key insight to the analyst about the major progress of the incident helping him to focus on important things. The similar incident widget again helps the analyst to …
Continue reading

Sources

Cloud Identities
On-Premises Identity events
Azure platform events
Defender and other Microsoft products
On-premises appliances
Linux events
The native microsoft sources are pretty easy to incorporate with the standard integrated data connectors
This same counts towards Azure activity, Azure VMs and …
Continue reading

AI and ML

We make use of UEBA for the correlation between anomalies, especially on the identity platform.

Next to that we use the Fusion rules that will detect multi-stage attack scenarios
Sentinel notebooks are not used a lot at this moment, because of the learning curve
Continue reading

Investigation Tools

We do not rely too much on the investigation tools. Investigation will primarily be done with investigation with KQL Queries. The investigation dashboard is looked into to identify the entities and a first overview of the timeline. After that we construct our own timeline by using our own queries
Continue reading

Sources

Here are some of the primary sources from which Microsoft Sentinel can collect data:
  1. Microsoft 365 Services: Data from Microsoft 365 services, including Exchange Online, SharePoint, Teams, and Azure Active Directory, were ingested to monitor email, document, and user activities.
  2. Azure Services: Data …
Continue reading

Investigation Tools

1. Data Query and Search: Microsoft Sentinel provided a powerful query language that allowed analysts to search and filter security data from various sources.
Impact: Analysts quickly retrieved relevant data, which resulted in reducing the time it takes to gather evidence and establish the scope of …
Continue reading

Sources

We pull data from On-Premises Sources and also from Custom Data Sources (using API)
When setting up these connectors, the process was relatively straightforward and well-documented. Microsoft Sentinel provides a user-friendly interface within the Azure portal, making it easy to configure data …
Continue reading

AI and ML

I Feel this feature gives Microsoft Sentinel an advantage from competitors. Because of this feature Microsoft Sentinel becomes more expensive than its competitor. We are yet to use this feature widely.
Continue reading

Investigation Tools

Microsoft Sentinel's investigation tools have had a positive impact on our incident investigation process. It made our investigations faster, more accurate, and more proactive, ultimately strengthening our organization's ability to detect threats effectively.
Continue reading

AI and ML

I think, this feature gives it upperhand from competitors and hence high pricing. We used: 1. Anomaly Detection : Microsoft Sentinel can generate alerts for potential anomalies. For example, it can identify unusual login patterns, data access, or network traffic. 2. Behavioural Analytics: By …
Continue reading

Investigation Tools

We can identify hazards in our environment, create incidents and triage them, monitor threats in real time, and do extensive investigations using AI functions. Cyber-attack mitigation. Information security, along with automation, is something that every organization requires right now, and …
Continue reading

Sources

We gather data from different data connectors such as Firewall, Endpoints, Servers, Amazon Web Services, Hypervisors, and more. There's a comprehensive list in the official documentation that helps to assess the possible integrations that can be made when it comes to deploying the product in the …
Continue reading

AI and ML

Threat detection in Microsoft Sentinel can be enhanced by AI and Machine Learning. It's something mainly based on the User Behaviour Analytics concept when it comes to machine learning, and it's heuristic counterpart helps to detect threats and respond to malicious behavior while correlating …
Continue reading

Investigation Tools

Microsoft Sentinel’s investigation tools really enhance the whole analysis process with its timeline bookmarks while not only correlating events just like any other SIEM but also integrating something that comes directly from the SOAR world, which means correlating incidents and highlighting …
Continue reading

Investigation Tools

The tool to look for any type of notification that anybody's trying to get into your boundary. When somebody gets a notification, they click on that notification and see what all systems were affected by the possible compromise. So being able to drill down to look at the root cause or whatever …
Continue reading

Sources

It's a Proofpoint email security then from my Palo Alto firewalls and from a graph and active directly. So all those, I can say network devices and endpoint devices, my XDR solution.
It takes little time because getting the resources in the market is quite challenging. When we started, because it …
Continue reading

Sources

Multiple. We have email ingest, all of the O365 stuff and our firewalls, mainly.
It wasn't that hard. It was just dropping the data and then pipelining it in, so it's not that bad.
Continue reading

AI and ML

Yes, we're using it right now just on the Microsoft stuff, since that's all it does. So if it were to branch out, we'd love it to do more networking and add behavioral and machine learning analytics around all of their data sources, not just Microsoft agnostic. We've successfully deployed it into …
Continue reading

Investigation Tools

They're pretty good. Their workbooks are where they really live up to a lot of their consolidation of data, so it's really good. Definitely made it a little bit easier in some questions, it's been good.
Continue reading

Sources

Other than the Microsoft Suite, like the Defender, Azure and all these, they get fed. We got Meraki, we got Cisco Umbrella, we got Windows Locks, we got Azure Arc getting fed into Sentinel as well.
Continue reading

Investigation Tools

We use it whenever there's an incident with medium and high. If we get an alert a query or something, we just look it up and see what are the lock from source destination, IP port, it's very helpful. You have everything in one place. Saved me time.
Continue reading

Awards

Products that are considered exceptional by their customers based on a variety of criteria win TrustRadius awards. Learn more about the types of TrustRadius awards to make the best purchase decision. More about TrustRadius Awards

Popular Features

View all 13 features
  • Centralized event and log data collection (14)
    8.6
    86%
  • Correlation (14)
    8.4
    84%
  • Event and log normalization/management (14)
    8.2
    82%
  • Custom dashboards and workspaces (14)
    7.4
    74%

Reviewer Pros & Cons

View all pros & cons
Return to navigation

Pricing

View all pricing

Azure Sentinel

$2.46

Cloud
per GB ingested

100 GB per day

$123.00

Cloud
per day

200 GB per day

$221.40

Cloud
per day

Entry-level set up fee?

  • No setup fee
For the latest information on pricing, visithttps://www.microsoft.com/en…

Offerings

  • Free Trial
  • Free/Freemium Version
  • Premium Consulting/Integration Services
Return to navigation

Product Demos

Microsoft Sentinel: Monitoring health and integrity of analytics rules

YouTube
Return to navigation

Features

Security Information and Event Management (SIEM)

Security Information and Event Management is a category of security software that allows security analysts to look at a more comprehensive view of security logs and events than would be possible by looking at the log files of individual, point security tools

8.4
Avg 7.8
Return to navigation

Product Details

What is Microsoft Sentinel?

Microsoft Sentinel is a security operations center (SOC) solution used to uncover sophisticated threats and respond with a security information and event management (SIEM) solution for proactive threat detection, investigation, and response. It eliminates security infrastructure setup and maintenance, and elastically scales to meet the user's security needs.

Helps users to protect the digital estate: Secures the digital estate with scalable, integrated coverage for a hybrid, multicloud, multiplatform business.

Microsoft intelligence to Empower SOC: Optimizes SecOps with advanced AI, security expertise, and threat intelligence.

Detection, investigation and Response: A unified set of tools to monitor, manage, and respond to incidents.

Cost of ownership: A cloud-native SaaS solution to reduce infrastructural costs.

Microsoft Sentinel Features

Security Information and Event Management (SIEM) Features

  • Supported: Centralized event and log data collection
  • Supported: Correlation
  • Supported: Event and log normalization/management
  • Supported: Deployment flexibility
  • Supported: Integration with Identity and Access Management Tools
  • Supported: Custom dashboards and workspaces
  • Supported: Host and network-based intrusion detection
  • Supported: Log retention
  • Supported: Data integration/API management
  • Supported: Behavioral analytics and baselining
  • Supported: Rules-based and algorithmic detection thresholds
  • Supported: Response orchestration and automation
  • Supported: Incident indexing/searching

Microsoft Sentinel Screenshots

Screenshot of Screenshot of Screenshot of Microsoft Sentinel Capabilities

Microsoft Sentinel Videos

Playlist for Microsoft Sentinel videos
Microsoft Sentinel: Monitoring health and integrity of analytics rules

Microsoft Sentinel Competitors

Microsoft Sentinel Technical Details

Deployment TypesSoftware as a Service (SaaS), Cloud, or Web-Based
Operating SystemsUnspecified
Mobile ApplicationNo

Frequently Asked Questions

Microsoft Sentinel (formerly Azure Sentinel) is designed as a birds-eye view across the enterprise. It is presented as a security information and event management (SIEM) solution for proactive threat detection, investigation, and response.

Splunk Enterprise Security (ES), IBM Security QRadar SIEM, and Securonix Next-Generation SIEM are common alternatives for Microsoft Sentinel.

Reviewers rate Deployment flexibility highest, with a score of 9.2.

The most common users of Microsoft Sentinel are from Enterprises (1,001+ employees).
Return to navigation

Comparisons

View all alternatives
Return to navigation

Reviews and Ratings

(67)

Attribute Ratings

Reviews

(1-3 of 3)
Companies can't remove reviews or game the system. Here's why
August 16, 2021

Sentinel Has Come A Long Way

MB
Michael Bobo
IT Director
Martin Retail Group (Marketing & Advertising, 201-500 employees)
Score 9 out of 10
Vetted Review
Verified User
Incentivized
Use Cases and Deployment Scope
Azure Sentinel was rolled out to the entire organization as part of a security initiative for our cloud environment. Being in a smaller IT group, but with lots of employees, it was important that we have a system that was awake when we weren't, and watching when we couldn't.
Pros and Cons
  • Automated detection and response
  • Detailed user/device information
  • Part of the MS cloudsphere, so has a familiar feel.
  • In the WFH world sometimes it would be nice to have a local client version when speed isn't the best from home
  • The ability to alert on a mobile device
  • A mobile app to do an investigation while on the move
Likelihood to Recommend
It is well suited if you are in a mostly Microsoft shop and want integrated security and tracking. It does work with other OSs but the depth of information and abilities is not as robust.
Microsoft Sentinel Feature Ratings
Security Information and Event Management (SIEM) (14)
88.57142857142858%
8.9
Centralized event and log data collection
100%
10.0
Correlation
100%
10.0
Event and log normalization/management
90%
9.0
Deployment flexibility
60%
6.0
Integration with Identity and Access Management Tools
100%
10.0
Custom dashboards and workspaces
80%
8.0
Host and network-based intrusion detection
80%
8.0
Log retention
90%
9.0
Data integration/API management
90%
9.0
Behavioral analytics and baselining
90%
9.0
Rules-based and algorithmic detection thresholds
90%
9.0
Response orchestration and automation
90%
9.0
Reporting and compliance management
90%
9.0
Incident indexing/searching
90%
9.0
SIEM Return on Investment
Net Positive ROI
this has replaced expensive hardware that had expensive maintenance contracts and didn't give the indepth reporting.
Next-Gen SIEM Features
  • Built-in/native behavioral analytics (baselining)
They have given baseline visibility into what our employees are doing with their equipment and actionable items for us to review.
Usability
9
My only real negative is a missing mobile app that would allow for on the move investigations.
Support Rating
5
I haven't yet had to use support for Sentinel.
Professional Services
5
Did not use professional services
Contract Terms and Pricing
8
With everything moving to a pay per month per user plan it would be nice to have some rollup products that just included everything.
July 22, 2021

One of the best cloud security solutions with intelligent analytics and automation.

Flavio Pereira | TrustRadius Reviewer
Flavio Pereira
Analista de sistemas
Nestlé (Food & Beverages, 10,001+ employees)
Score 10 out of 10
Vetted Review
Verified User
Incentivized
Use Cases and Deployment Scope
Azure Sentinel has been used by our headquarters as a SIEM solution. Easy to learn, set up and use. Because it is highly scalable and cloud based, it has become ideal for managing events and providing security automation by creating automated SOAR responses to different levels of incidents, from undiscovered, simple to more complex. It has collaborated a lot in making business decisions and providing more security for the team and the organization.
Pros and Cons
  • Easy to deploy and learn to use.
  • Artificial intelligence.
  • Analysis of any type of threat, including those that have not yet been discovered.
  • Automation to respond to security incidents.
  • Reduction of false positives.
  • Easy to edit log analysis rules.
  • The reporting feature can be improved. I sometimes see problems with exportation, instability and compatibility.
  • Dependence on Microsoft Azure software.
Likelihood to Recommend
Azure Sentinel is an excellent option like SIEM. It has cool, smart features and functionality, and is quite powerful in terms of processing information in the cloud. I recommend it to colleagues because it is very easy to deploy and configure, and learn to use it on a daily basis. The panel is super intuitive and rich in details. When opening Sentinel, it is already possible to analyze the indices that happened and those that deserve further attention and treatment.
Microsoft Sentinel Feature Ratings
Security Information and Event Management (SIEM) (14)
96.42857142857142%
9.6
Centralized event and log data collection
100%
10.0
Correlation
90%
9.0
Event and log normalization/management
100%
10.0
Deployment flexibility
100%
10.0
Integration with Identity and Access Management Tools
90%
9.0
Custom dashboards and workspaces
100%
10.0
Host and network-based intrusion detection
100%
10.0
Log retention
90%
9.0
Data integration/API management
100%
10.0
Behavioral analytics and baselining
90%
9.0
Rules-based and algorithmic detection thresholds
100%
10.0
Response orchestration and automation
100%
10.0
Reporting and compliance management
100%
10.0
Incident indexing/searching
90%
9.0
Return on Investment
  • Better automation against safety indices.
  • Better visualization of threats, deals and solutions.
  • Great for checking attempted violations.
Support Rating
10
Microsoft support is one of the highest rated on the market. It has global and multilingual support. Calls can be made over the phone and the solution is virtually instantaneous with the help of Microsoft engineers. It's great!
Usability
9
The Microsoft Azure Sentinel solution is very good and even better if you use Azure. It's easy to implement and learn how to use the tool with an intuitive and simple interface. New updates are happening to always bring new news and improve the experience and usability. The solution brings reliability as it is from a very reliable manufacturer.
July 22, 2021

Azure Sentinel is your go to solution for your Azure resources

Verified User
Manager in Information Technology
Information Technology & Services Company, 201-500 employees
Score 10 out of 10
Vetted Review
Verified User
Incentivized
Use Cases and Deployment Scope
Azure Sentinel is currently being used as our single location where we check all the monitoring alerts we get on our Azure resources.
Pros and Cons
  • The UI-based analytics are excellent
  • Excellent tools for cleaning data, sorting out irrelevant log data, and even fixing log data.
  • There's not much that needs improvement, but the on-prem log sources still require a lot of development.
Likelihood to Recommend
Azure Sentinel is your to go to software if you are using Azure as your cloud hosting partner. It can give you a lot of flexibility when in comes in your security dashboards.
Microsoft Sentinel Feature Ratings
Security Information and Event Management (SIEM) (14)
97.85714285714286%
9.8
Centralized event and log data collection
100%
10.0
Correlation
90%
9.0
Event and log normalization/management
100%
10.0
Deployment flexibility
90%
9.0
Integration with Identity and Access Management Tools
100%
10.0
Custom dashboards and workspaces
100%
10.0
Host and network-based intrusion detection
90%
9.0
Log retention
100%
10.0
Data integration/API management
100%
10.0
Behavioral analytics and baselining
100%
10.0
Rules-based and algorithmic detection thresholds
100%
10.0
Response orchestration and automation
100%
10.0
Reporting and compliance management
100%
10.0
Incident indexing/searching
100%
10.0
Return on Investment
  • Cost saving as you don't need to use multiple platforms to monitor your security events.
Support Rating
10
Azure Sentinel is very easy to use and configure. If you are stuck somewhere, Microsoft support is excellent in assisting and solving your issue.
Usability
10
Very easy to use and easy to learn how to manage it.
Return to navigation