Try our new research platform with insights from 80,000+ expert users

Graylog Security vs Microsoft Defender XDR comparison

 

Comparison Buyer's Guide

Executive Summary

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Graylog Security
Average Rating
8.6
Reviews Sentiment
7.5
Number of Reviews
2
Ranking in other categories
Security Information and Event Management (SIEM) (42nd)
Microsoft Defender XDR
Average Rating
8.4
Reviews Sentiment
7.1
Number of Reviews
106
Ranking in other categories
Endpoint Detection and Response (EDR) (7th), Extended Detection and Response (XDR) (4th), Microsoft Security Suite (5th)
 

Mindshare comparison

While both are Security Software solutions, they serve different purposes. Graylog Security is designed for Security Information and Event Management (SIEM) and holds a mindshare of 0.6%, up 0.5% compared to last year.
Microsoft Defender XDR, on the other hand, focuses on Extended Detection and Response (XDR), holds 4.8% mindshare, down 6.8% since last year.
Security Information and Event Management (SIEM) Market Share Distribution
ProductMarket Share (%)
Graylog Security0.6%
Splunk Enterprise Security7.1%
Wazuh6.4%
Other85.9%
Security Information and Event Management (SIEM)
Extended Detection and Response (XDR) Market Share Distribution
ProductMarket Share (%)
Microsoft Defender XDR4.8%
CrowdStrike Falcon10.1%
Wazuh7.2%
Other77.9%
Extended Detection and Response (XDR)
 

Featured Reviews

Tony Zafiropoulos - PeerSpot reviewer
Owner/ Chief Engineer at Fixvirus.com
Aggregates logs in one place and helps to review data points
We tried Graylog Security, starting with their inexpensive open-source version. We tested it out and continued using it for a while. As for the main differences between Graylog Security and other vendors, some users might prefer cloud-based platforms over on-premises solutions. It isn't inherently cloud-native, but that might not matter much for some.
KO
House security operator at Cypress Creek Renewables
Advanced threat hunting saves significant time in tracking and responding to incidents
Microsoft Defender XDR could be improved with a lower price. My main suggestion would essentially be what Copilot is providing, which is a single pane of glass, so I don't have to go to different windows. That's just a workflow consideration for me. It would be great to have all the information centralized into one particular data app. If I need to open up extra ones, I can, however, I would appreciate a future where everything I need is right there on one single pane of glass. Beyond that, there's really nothing else I see that I would want Microsoft to improve.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"We use the solution to collect logs."
"The tool aggregates logs. We can see the logs in one place."
"In our company,we have faced multiple attacks over the last few months, but none of them have been successful, and I think Microsoft Defender XDR has played a major role in it."
"The integration between all the Defender products is the most valuable feature."
"Based on what I've seen with Microsoft Defender XDR and the large amount of threat data Microsoft has access to, I'm confident I would trust Microsoft Security to handle the majority of all our threats from any threat actor who's essentially putting our company at risk."
"I like 365 Defender's advanced threat hunting. The dashboard is user-friendly with templates for site policies, etc. The most important use case is evaluating the risk links and applications."
"The timeline feature is excellent. I also like the phishing simulation. We have phishing campaigns to educate employees and warn them about these threats."
"The common and advanced security policies for threat hunting and blocking attacks are valuable."
"Microsoft Defender XDR is a complete package of different Defender solutions, including Defender for Endpoint, Defender for Office 365, Defender for Cloud, and Sentinel SIEM, among others."
"Vulnerability assessment and just-in-time access are some valuable features of Defender for server plans."
 

Cons

"Graylog Security needs to incorporate security scorecards."
"The Defender agent itself is more compatible with Windows 10 and Windows 11. Other than these two lines, there are so many compatibility issues. Security is not only about Microsoft. The core technical aspects of it are quite good, but it would be good if they can better support non-Microsoft solutions in terms of putting the agents directly into VMware and other virtualization solutions. There should be more emphasis on RHEL and other operating systems that we use, other than Windows, in the server category."
"Sometimes, digging into the information and knowing where to go can be difficult. It would be better if much of that information were immediately visible, especially when looking at endpoints or users."
"There is no comprehensive visibility, making it less user-friendly."
"We should be able to use the product on devices like Apple, Linux, etc."
"The initial time spent setting up and configuring Defender XDR is a bit longer than the other solutions. If everything were on one portal, the platforms for managing policies or alerts would be simpler. We must automate and manage policies on Intune rather than the same portal."
"There is no comprehensive visibility, making it less user-friendly."
"The logs could be better."
"Microsoft support is not very good. You get stuck in low-level support for way longer than you should, instead of them escalating the issue up the chain."
 

Pricing and Cost Advice

"I rate the tool's pricing a one out of ten."
"The bundling of software makes it easier to manage our setup, but Microsoft purposefully obfuscates this through marketing ploys to hide costs."
"Defender XDR is included in the E5 license, but it's a bit too expensive."
"The price could be better. Normally, the costs depend on the country you're located in for the license. When we were in the initial stage, we went with the E5 license they call premium standard. It cost us around $5.20 per month for four users."
"The solution is too expensive."
"For Defender, they have Endpoint Plan 1 and Endpoint Plan 2, but I don't know on what basis they have classified Endpoint Plan 1 and Plan 2, but it has given me enough pain to pick and design Endpoint Plan 1 or Endpoint Plan 2 for my organization. In fact, we are still struggling with it. Too many SKUs are confusing. There should not be too many SKUs, and they shouldn't charge for every new feature."
"365 Defender is billed per account. I don't know the exact price, but my supervisor told me that Microsoft Defender is cheaper than the alternatives. It's bundled, so you get all the features in one place."
"Microsoft Defender XDR's licensing is complicated."
"Purchasing Microsoft Defender XDR as part of a Microsoft 365 bundle can be cost-effective, but acquiring it as a standalone product may be more expensive."
report
Use our free recommendation engine to learn which Security Information and Event Management (SIEM) solutions are best for your needs.
881,733 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Educational Organization
12%
Financial Services Firm
9%
Retailer
7%
Comms Service Provider
7%
Computer Software Company
13%
Financial Services Firm
9%
Manufacturing Company
8%
Comms Service Provider
7%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
No data available
By reviewers
Company SizeCount
Small Business47
Midsize Enterprise25
Large Enterprise38
 

Questions from the Community

What do you like most about Graylog Security?
The tool aggregates logs. We can see the logs in one place.
What is your primary use case for Graylog Security?
I feed different data points to the tool and review them.
What advice do you have for others considering Graylog Security?
I rate the overall product an eight out of ten. It's a good option for getting started.
What do you like most about Microsoft 365 Defender?
Microsoft Defender XDR provides strong identity protection with comprehensive insights into risky user behavior and potential indicators of compromise.
What is your experience regarding pricing and costs for Microsoft 365 Defender?
My experience with pricing, setup, costs, and licensing of Microsoft Defender XDR is tied to our E5 subscription, which is very straightforward for us. We also purchase the uplift for our mobile us...
What needs improvement with Microsoft 365 Defender?
I am not aware of a mobile app that would be available for my team. With a single analyst, if she is ever away, it would be beneficial to have easier access. While she can use the web portal, the e...
 

Also Known As

No data available
Microsoft 365 Defender, Microsoft Threat Protection, MS 365 Defender
 

Overview

 

Sample Customers

Information Not Available
Accenture, Deloitte, ExxonMobil, General Electric, IBM, Johnson & Johnson and many others.
Find out what your peers are saying about Splunk, Wazuh, IBM and others in Security Information and Event Management (SIEM). Updated: February 2026.
881,733 professionals have used our research since 2012.