How I use Microsoft Sentinel to keep up in a Multi-client SOC
December 16, 2025

How I use Microsoft Sentinel to keep up in a Multi-client SOC

Kiera Lille | TrustRadius Reviewer
Score 7 out of 10
Vetted Review
Verified User

Overall Satisfaction with Microsoft Sentinel

We support a mix of enterprise clients: banks, retail chains with weird legacy systems. So Microsoft Sentinel helps us wrangle all their logs into one place without losing our minds. My main day to day is triaging incidents coming from Microsoft Sentinel analytics and running KQL queries.

Pros

  • We get clean unified views across multiple clients
  • Built in hunting queries and analytics

Cons

  • As a junior analyst, I've struggled a lot with the learning curve. I had to pull off all-nighters at the start, just to wrap my head around Microsoft Sentinel
  • I can't imagine a world without Microsoft Sentinel for investigations and triaging. The manual hours that would take is bogus
  • Peace of mind for our financial clients who make up the majority of our client base
Cloud identity and productivity logs. Endpoint and EDR data Firewall and network logs Cloud infrastructure logs
As a junior, my experience with these is insignificant at the moment, but it's something I'm looking to explore in the coming months.
Microsoft Sentinel isn't an easy tool. Most times it feels like I'm punching above my weight.

Do you think Microsoft Sentinel delivers good value for the price?

Yes

Are you happy with Microsoft Sentinel's feature set?

No

Did Microsoft Sentinel live up to sales and marketing promises?

I wasn't involved with the selection/purchase process

Did implementation of Microsoft Sentinel go as expected?

I wasn't involved with the implementation phase

Would you buy Microsoft Sentinel again?

Yes

I've learned to work around the automation and dashboards but I still stumble sometimes on writing the right KQL queries. It's a fit for anything to do with hunting, correlation and auto enrichments. You'll occasionally get overwhelmed with the alert storms. It's not Microsoft Sentinel's fault but it does require careful triage.

Microsoft Sentinel Feature Ratings

Security Information and Event Management (SIEM)
7.8
Centralized event and log data collection
9
Correlation
8
Event and log normalization/management
9
Deployment flexibility
8
Integration with Identity and Access Management Tools
7
Custom dashboards and workspaces
8
Host and network-based intrusion detection
6
Log retention
8
Data integration/API management
7
Behavioral analytics and baselining
9
Rules-based and algorithmic detection thresholds
8
Response orchestration and automation
7
Incident indexing/searching
8

Comments

More Reviews of Microsoft Sentinel

  1. Home
  2. Security Information and Event Management (SIEM) Software
  3. Microsoft Sentinel Reviews
  4. User Review of Microsoft Sentinel