Microsoft Sentinel
Cloud-native SIEM and SOAR running on Azure with per-GB analytics pricing.
What Is Microsoft Sentinel?
Microsoft Sentinel is a cloud SIEM built on Azure Log Analytics, with analytics rules, automation playbooks through Logic Apps, and ATT&CK-mapped detections. It sits close to Defender and Entra telemetry, and KQL gives analysts query depth across all ingested data. Pricing follows ingestion and retention, with commitment tiers for volume. After March 31, 2027, Sentinel is available only in the Microsoft Defender portal, not the Azure portal.
Use Cases
Microsoft-centric estates that want SIEM and SOAR without managing infrastructure.
Strengths and Limitations
Strengths
- +Built-in connectors for Microsoft sources such as Microsoft Entra ID and Defender XDR.
- +KQL is the same query language used in Azure Monitor and Azure Data Explorer.
- +No infrastructure to operate.
Limitations
- -Costs are sensitive to ingestion discipline.
- -Data is stored in Azure Monitor Log Analytics workspaces, which ties deployments to Azure.
Defensive Use
Cloud SIEM correlation and automated response across Microsoft and third-party sources.
Microsoft Sentinel Alternatives
| Tool | License | Platforms | Pricing |
|---|---|---|---|
| Elastic Security SIEM and XDR built on the Elastic Stack with open detection rules and endpoint integration. | Elastic-2.0 (Security solution, detection rules); AGPL-3.0-only OR SSPL-1.0 OR Elastic-2.0 (Elasticsearch, Kibana core) | Web, Linux, macOS, Windows | Free / Commercial |
| Google SecOps Cloud-native SIEM and SOAR platform, formerly Google Chronicle, with retro-hunting over year-long retention. | Proprietary | Web | Commercial |
| Splunk Search-driven SIEM and observability platform, owned by Cisco since 2024. | Proprietary | Web, Linux, Windows | Free / Commercial |
Frequently Asked Questions
What is Microsoft Sentinel?→
Microsoft Sentinel is a cloud SIEM built on Azure Log Analytics, with analytics rules, automation playbooks through Logic Apps, and ATT&CK-mapped detections. It sits close to Defender and Entra telemetry, and KQL gives analysts query depth across all ingested data. Pricing follows ingestion and retention, with commitment tiers for volume. After March 31, 2027, Sentinel is available only in the Microsoft Defender portal, not the Azure portal.
What is Microsoft Sentinel used for?→
Microsoft-centric estates that want SIEM and SOAR without managing infrastructure.
What are the strengths of Microsoft Sentinel?→
- +Built-in connectors for Microsoft sources such as Microsoft Entra ID and Defender XDR.
- +KQL is the same query language used in Azure Monitor and Azure Data Explorer.
- +No infrastructure to operate.
What are the limitations of Microsoft Sentinel?→
- +Costs are sensitive to ingestion discipline.
- +Data is stored in Azure Monitor Log Analytics workspaces, which ties deployments to Azure.
How is Microsoft Sentinel used defensively?→
Cloud SIEM correlation and automated response across Microsoft and third-party sources.