Microsoft Sentinel

Score8.5 out of 10

102 Reviews and Ratings

What is Microsoft Sentinel?

Microsoft Sentinel (formerly Azure Sentinel) is designed as a birds-eye view across the enterprise. It is presented as a security information and event management (SIEM) solution for proactive threat detection, investigation, and response.

Categories & Use Cases

Media

1 / 3

Reporting and compliance management
Ease and quality of reporting and compliance functions
Category average: 8.3
Incident indexing/searching
Effectiveness of searching across structured and unstructured events and incidents within SIEM
Category average: 8.8
Centralized event and log data collection
Effectiveness of real-time centralized event and log data collection
Category average: 9

Integration with Identity and Access Management Tools
Integration with access control tools like Active Directory and LDAP
Category average: 7.7
Data integration/API management
Ease and quality of data integrations between SIEM and other systems
Category average: 8.1
Host and network-based intrusion detection
Ability to detect both endpoint intrusion and network ingress detection
Category average: 7.4

Harshit Lal View profile

security consultant in Information Technology at wipro (10,001+ employees employees)

Use Cases and Deployment Scope

Microsoft Sentinel is used both as siem and soar solution in our customer environment . We are also sending logs from Microsoft Sentinel to prisma. We are running kql queries on Microsoft Sentinel to do threat hunting

Pros

siem solution
automation with runbooks
soar solution
compatible with other vendor solution
providing compliance

Cons

ticketing system
other third party app should also be compatible
pricing
better features for hybrid cloud

Return on Investment

reduced cost occured for legacy system and saving 50000 dollar upto 1 year
reduced false positive incidents up to 90 percent
faster deployment over 100000 dollar up to 1 year

Alternatives Considered

Splunk Cloud

Other Software Used

Splunk Cloud, IBM Security QRadar EDR, LogRhythm NetworkXDR

Ian Stuebe

Project Manager in Information Technology at Apex Warehouse Systems (51-200 employees employees)

Use Cases and Deployment Scope

We track all our systems to protect them from any threats with Microsoft Sentinel. Before Microsoft Sentinel, it was challenging to monitor our systems and fix security issues and threats fast and in time to keep our data safe. Faster alerts are easy to obtain, and we can react and correct them more quickly to protect our data.

Pros

Keeps Everything in one place
Smart threat detection
Automatic response to threats
Clear visuals and reports

Cons

Setting up automation is complicated
Too many alerts at first
complicated permissions setup

Return on Investment

We catch problems faster
Everything is in one place
Less manual work for the team
Good return on investment

Alternatives Considered

Sumo Logic

Other Software Used

Miro, SAP Sales Cloud, Webex Meetings

Richard Dornhart

National Security Practice Manager in Sales at Data#3 (1001-5000 employees employees)

Use Cases and Deployment Scope

Internally we use it to gain visibility around threats within the organization, but primarily we consult with other organizations to deploy and implement Sentinel. We have a managed service built around Sentinel. So we use Sentinel as part of our managed XDR solution that we've developed with Microsoft.

Pros

Well, that's a good question. It does a lot, well, probably my engineers would be better positioned to answer that question, but it correlates really well. Security orchestration, it highlights risks in the organization, provides insights to our analysts to respond to threats and it implements well.

Cons

The licensing could be a little bit simpler

Return on Investment

Probably one of my main business objectives is to drive services for our organization. Sentinel provides numerous opportunities for us to drive those services. Implementation, ongoing management, and I think because of our customer base, so interested in SOC services and our focus on Sentinel. Yeah, profitability is our objective and it helps us achieve that.

Other Software Used

Microsoft Defender for Endpoint

Usability

Mohamad Islam Hamadieh View profile

SOC Engineer in Engineering at Dell technology (10,001+ employees employees)

Use Cases and Deployment Scope

Microsoft Sentinel is used as log management and SIEM tool , the tool replaces legacy on prem SIEMs having all your logs in the cloud.

the tool solves security monitoring and threat hunting problems.

it also enables an integrated automation solution (logic apps) from within the solution it self .

the connectors (log source integrations )usually comes with multiple detection rules and dashboards

Pros

Very good UI
Very good support to MS log sources
Good Threat hunting module
Automation through logic apps

Cons

Having less rapid changes of terminologies
Having less rapid changes in documentation
Having better documentation for connectors

Return on Investment

Made it so easy to integrate MS solutions into SIEM

Alternatives Considered

LogRhythm NextGen SIEM Platform and IBM Security QRadar SIEM

Other Software Used

IBM Security QRadar SOAR, Palo Alto Networks Cortex XSOAR, Splunk Enterprise Security

Rajesh Kumar

Senior Vice President in Information Technology at EXL Service (10,001+ employees employees)

Use Cases and Deployment Scope

Sentinel for us is the core sim engine. That is where all my event logs get correlated and it is the nerve hub of my security operation center.

Pros

What has worked well for me and my company is this is a SaaS product, so the access and the availability from that perspective is significantly high. Integration I think was above average for most of the devices as well as the user interface is good.

Cons

Dashboard is not very good. Some of the interfaces and the integration needs so much more work.

Return on Investment

I'll say neutral.

IBM Security QRadar SIEM

Securonix Next-Generation SIEM

Splunk Enterprise Security

Microsoft Sentinel

What is Microsoft Sentinel?

Categories & Use Cases

Media

Key Features

Top Performing Features

Reporting and compliance management

Incident indexing/searching

Centralized event and log data collection

Areas for Improvement

Integration with Identity and Access Management Tools

Data integration/API management

Host and network-based intrusion detection

Reviews

Use Cases and Deployment Scope

Pros

Cons

Return on Investment

Alternatives Considered

Other Software Used

Use Cases and Deployment Scope

Pros

Cons

Return on Investment

Alternatives Considered

Other Software Used

Use Cases and Deployment Scope

Pros

Cons

Return on Investment

Other Software Used

Usability

Use Cases and Deployment Scope

Pros

Cons

Return on Investment

Alternatives Considered

Other Software Used

Use Cases and Deployment Scope

Pros

Cons

Return on Investment

Related Products