G2

Divakara B.

Detection Engineer

Enterprise (> 1000 emp.)

11/4/2026

Business partner of the seller or seller's competitor, not included in G2 scores.

"Seamless Microsoft Sentinel Integration with Powerful KQL and Automation"

5/5

What do you like best about Microsoft Sentinel?

What I like most about Microsoft Sentinel is how well it integrates with the rest of the Microsoft ecosystem, including Defender, Entra ID, Microsoft 365 and Azure. Data connectors are quick to set up, so we could start getting visibility without a long deployment. Being cloud-native means there is no infrastructure to maintain, and it scales as log volumes grow. I also value KQL for threat hunting and custom analytics rules, along with built-in workbooks and playbooks (Logic Apps) that automate repetitive incident response tasks and cut down triage time. Review collected by and hosted on G2.com.

What do you dislike about Microsoft Sentinel?

The biggest drawback is cost predictability. Pricing is based on data ingestion, so bills can climb quickly as more log sources are onboarded, and it takes ongoing effort to filter noisy data and choose the right tiers to keep spend under control. The learning curve is also steep for new analysts, because getting real value from hunting and custom analytics rules requires solid KQL skills. Some out-of-the-box analytics rules generate a lot of false positives until they are tuned, and the portal can feel fragmented as features move between the Azure and Defender portals. Documentation helps, but troubleshooting complex connector issues sometimes takes more effort than it should. Review collected by and hosted on G2.com.

What problems is Microsoft Sentinel solving and how is that benefiting you?

Before Sentinel, our security logs were spread across multiple tools, which made it slow to correlate events and investigate incidents. Analysts spent a lot of time switching between consoles and manually enriching alerts. With Sentinel, we now have a single cloud-native SIEM that collects data from endpoints, identity, cloud workloads and network sources in one place. Automated playbooks handle repetitive tasks like alert enrichment and ticket creation, so analysts can focus on real threats. This has shortened our triage and response times, improved visibility across our environment, and made compliance reporting easier because the evidence is in one searchable place. Review collected by and hosted on G2.com.