Microsoft Sentinel Reviews & Product Details

What I like most about Microsoft Sentinel is how well it integrates with the rest of the Microsoft ecosystem, including Defender, Entra ID, Microsoft 365 and Azure. Data connectors are quick to set up, so we could start getting visibility without a long deployment. Being cloud-native means there is no infrastructure to maintain, and it scales as log volumes grow. I also value KQL for threat hunting and custom analytics rules, along with built-in workbooks and playbooks (Logic Apps) that automate repetitive incident response tasks and cut down triage time. Review collected by and hosted on G2.com.

The biggest drawback is cost predictability. Pricing is based on data ingestion, so bills can climb quickly as more log sources are onboarded, and it takes ongoing effort to filter noisy data and choose the right tiers to keep spend under control. The learning curve is also steep for new analysts, because getting real value from hunting and custom analytics rules requires solid KQL skills. Some out-of-the-box analytics rules generate a lot of false positives until they are tuned, and the portal can feel fragmented as features move between the Azure and Defender portals. Documentation helps, but troubleshooting complex connector issues sometimes takes more effort than it should. Review collected by and hosted on G2.com.

Correlates logs across our multi-tenant environment really well, especially with custom analytics rules. Integration with Log Analytics and the automation rules (like auto-ticket creation) saves a lot of manual triage time. Threat hunting queries in KQL are powerful once you get the hang of them, way more flexible than our old SIEM. Liked the overall UI-UX. performance compared to other SIEM tools and and they now also provide inbuilt AI agent integration work even more faster and smarter. Review collected by and hosted on G2.com.

Cost can spiral fast once log ingestion volume goes up, especially with verbose data connectors like firewall logs.

Some out-of-the-box analytics rules generate noisy alerts, needed a lot of tuning before they were actually useful. Review collected by and hosted on G2.com.

We can ingest logs of any format without doing ssh into the vms and the log collection is very easy and also we can integrate sentinel with defender xdr and also with other cloud like aws etc. Review collected by and hosted on G2.com.

We cannot ingest different log type using one data collection rule, we must have to create different data collection rule to collect different log type like text logs, cef etc. Also we must have to create different table for different log type like if i have to collect application logs then we must have to create separate table. Review collected by and hosted on G2.com.

1. Cloud-Native Architecture & Scalability

2. Deep Ecosystem Integration

3. Native SIEM and SOAR Convergence

4. Powerful Investigation & Hunting Tools

5. AI-Driven Enhancements (Security Copilot) Review collected by and hosted on G2.com.

1. Cost Management and Unpredictable Pricing

2. Kusto Query Language (KQL) Learning Curve

3. Third-Party Integration support

4. Complexity Rule Tuning as well as Alert fatigue Review collected by and hosted on G2.com.

Sentinel provides strong, centralized visibility across cloud, on-prem, and hybrid environments, which makes security monitoring and incident investigation much more efficient for SOC operations. It offers native integrations such as Entra ID, Defender CDR, and Microsoft 365 and Azure services, along with third-party integrations to ingest logs into centralized storage in the Log Analytics workspace. Another major advantage is its scalability and flexibility: because it’s cloud-based, onboarding data sources and scaling are easier compared to managing traditional on-prem SIEM infrastructure. Overall, it delivers strong detection capabilities and improves response efficiency. Review collected by and hosted on G2.com.

The main thing is cost management can became difficult ingestion cost and retention cost still it can be reduced based on the logs that we are ingesting the workspace.But for large organiztion it won't be compromised. Review collected by and hosted on G2.com.

I love the centralized visibility that Microsoft Sentinel offers as it allows me to see logs, alerts, and incidents all in one place without jumping between tools, which speeds up investigations. I really like the built-in analytics and detection rules; they're ready to use and customizable, so I don't have to start from scratch. The integration with the Microsoft ecosystem, including Azure, Microsoft 365, and Defender tools, is also super smooth and almost seamless, making onboarding easier. Review collected by and hosted on G2.com.

A few things with Microsoft Sentinel could definitely be improved, like cost visibility. Pricing can be confusing, especially with the data ingestion. It's easy to overshoot if you are not keeping an eye on it. And, there's a learning curve; it takes time to get comfortable writing queries. Also, while the out-of-the-box rules are helpful, you still need to fine-tune them to reduce noise. Review collected by and hosted on G2.com.

What I like most about Microsoft Sentinel is how it delivers centralized security monitoring across multiple data sources in a cloud-native environment. It simplifies collecting, analyzing, and correlating large volumes of security logs, without the overhead of managing traditional SIEM infrastructure. The built-in analytics rules, threat intelligence integration, and playbook-based automation also help detect and respond to threats more efficiently. I’ve found its integration with other Microsoft security services especially valuable because it creates a more unified view of security incidents and helps security teams investigate and respond more quickly. Review collected by and hosted on G2.com.

One challenge with Microsoft Sentinel is that the initial setup and configuration can be time-consuming, especially for teams that are new to SIEM platforms or Azure services. Some analytics rules and data connectors also need careful tuning to cut down on false positives and make sure the alerts stay relevant. On top of that, the data-ingestion-based pricing model can get expensive if you collect large volumes of logs without proper filtering. For this reason, organizations should plan their log sources and retention strategy thoughtfully so they can keep costs under control while still capturing the logs they need. Review collected by and hosted on G2.com.

KQL is a really powerful language and easy to learn. If you are an Azure customer, Sentinel is a no-brainer, as it's really easy to ingest Azure Logs. It's integration with Defender is also a great plus, not to mention for a big number of tables which are free to ingest. Review collected by and hosted on G2.com.

I'd prefer for the data to be normalized and not be fragmented on multiple tables, in that way. The ASIM functions mitigate this problem, but they are slow. Review collected by and hosted on G2.com.

Easy to start . Less setup. As it’s cloud-native, there’s no infrastructure setup and connecting data sources like Azure resources or Microsoft 365 feels pretty straightforward. In my experience scalability and maintainability were important as the environment grows over the time and Sentinel was much of less work. Review collected by and hosted on G2.com.

When I had to deal with customization , it felt a complex as I had to learn about analytics rules and workbooks but still not obvious about how things are working together. The learning curve was steep for my level of usage. Review collected by and hosted on G2.com.

What I appreciate most about Microsoft Sentinel is its seamless combination of SIEM and SOAR within a truly cloud-native environment. Its strong integration with the Microsoft ecosystem—particularly Azure, Entra ID, Defender, and M365—delivers immediate visibility and requires very little onboarding effort. The platform’s use of KQL empowers flexible and robust threat hunting, while the built-in analytics rules and UEBA features help to significantly reduce alert fatigue. Additionally, automation via Logic Apps enables security teams to respond more quickly and consistently, making Sentinel a highly scalable and cost-effective solution for today’s SOC operations. Review collected by and hosted on G2.com.

One aspect I find challenging about Microsoft Sentinel is managing costs, particularly as usage grows, because the pricing model relies heavily on the amount of data ingested and retained. While KQL is a powerful tool, it presents a learning curve for teams who are new to it, which can slow down the adoption process. In addition, implementing advanced SOAR use cases often demands considerable customization through Logic Apps, and troubleshooting these automations can be quite complex. Lastly, Sentinel tends to work best within the Microsoft ecosystem, which can be a drawback for organizations that rely on a variety of non-Microsoft security tools. Review collected by and hosted on G2.com.