G2

vimal p.

Sr. Security Analyst

Mid-Market (51-1000 emp.)

8/12/2026

"Best Cloud native SIEM - Microsoft Sentinel"

4.5/5

What do you like best about Microsoft Sentinel?

Correlates logs across our multi-tenant environment really well, especially with custom analytics rules. Integration with Log Analytics and the automation rules (like auto-ticket creation) saves a lot of manual triage time. Threat hunting queries in KQL are powerful once you get the hang of them, way more flexible than our old SIEM. Liked the overall UI-UX. performance compared to other SIEM tools and and they now also provide inbuilt AI agent integration work even more faster and smarter. Review collected by and hosted on G2.com.

What do you dislike about Microsoft Sentinel?

Cost can spiral fast once log ingestion volume goes up, especially with verbose data connectors like firewall logs.

Some out-of-the-box analytics rules generate noisy alerts, needed a lot of tuning before they were actually useful. Review collected by and hosted on G2.com.

What problems is Microsoft Sentinel solving and how is that benefiting you?

Sentinel gives us a single pane of glass to correlate alerts across multiple customer tenants instead of jumping between siloed tools.

Automation rules handle ticket creation automatically, which has cut down a lot of manual triage work for our SOC team.

It's also made incident response faster since we can pivot from an alert straight into the raw logs for investigation.

Multi-tenant support fits well with our MSSP model, letting us manage several customer environments from one setup Review collected by and hosted on G2.com.