IBM Resilient vs Microsoft Sentinel comparison

IBM and Microsoft are both solutions in the Security Orchestration Automation and Response (SOAR) category. IBM is ranked #16 with an average rating of 7.0, while Microsoft is ranked #1 with an average rating of 8.4. IBM holds a 2.0% mindshare in SOAR, compared to Microsoft’s 13.0% mindshare. Additionally, 75% of IBM users are willing to recommend the solution, compared to 94% of Microsoft users who would recommend it.

Comparison Buyer's Guide

Download the report

Executive SummaryUpdated on Dec 5, 2024

IBM Resilient and Microsoft Sentinel are leaders in incident response and security management. Microsoft Sentinel often has the upper hand due to its native integration within the Microsoft ecosystem, which enhances its performance and holistic threat management.

Features: IBM Resilient offers flexibility and customization with its dynamic playbooks and automation, apt for comprehensive incident management. Microsoft Sentinel excels in AI capabilities, data connectors, and provides a single-pane view that integrates effortlessly with Microsoft products, enhancing real-time threat detection.

Room for Improvement: IBM Resilient needs enhanced integration with third-party tools and a streamlined cost structure for easier initial setup. Microsoft Sentinel's complex pricing model could improve alongside its integration with non-Microsoft products. Both solutions should focus on better support and documentation for easier deployment.

Ease of Deployment and Customer Service: IBM Resilient’s on-premises deployment leads to complex setups, although its technical support is generally responsive. Microsoft Sentinel’s cloud-based architecture allows for quick deployment, but documentation and support responsiveness need improvement.

Pricing and ROI: IBM Resilient’s high pricing model can negatively impact ROI, with costs accumulating based on users and additional platform fees. Microsoft Sentinel’s consumption-based pricing could become expensive with high data ingestion, yet it typically offers better ROI due to absence of on-premises maintenance costs and efficient cloud-based features.

To learn more, read our detailed IBM Resilient vs. Microsoft Sentinel Report (Updated: December 2025).

Buyer's Guide

IBM Resilient vs. Microsoft Sentinel

December 2025

Download the complete report

Helped 879,889 peers since 2012

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Categories and Ranking

Torq

Mindshare comparison

As of January 2026, in the Security Orchestration Automation and Response (SOAR) category, the mindshare of Torq is 4.9%, up from 4.5% compared to the previous year. The mindshare of IBM Resilient is 2.0%, down from 2.3% compared to the previous year. The mindshare of Microsoft Sentinel is 13.0%, down from 20.5% compared to the previous year. It is calculated based on PeerSpot user engagement data.

Security Orchestration Automation and Response (SOAR) Market Share Distribution
Product	Market Share (%)
Microsoft Sentinel	13.0%
Torq	4.9%
IBM Resilient	2.0%
Other	80.1%

Security Orchestration Automation and Response (SOAR)

Featured Reviews

reviewer2767650

Senior Consultant at a university with 10,001+ employees

Have found automation to save analyst time but miss more accurate data classification

From our research and testing with the tool, we determined there need to be modifications and changes to train the LLM on the back end. It was able to capture data but was unable to differentiate between the agent hostname we are using and the hostname that resides on the back end of the Internet. It was unable to do that sort of classification. We concluded this tool would be more suitable for initial ticket management rather than security automation. Regarding data handling, I would give preference to Torq. For case management, Cortex and its dashboards prove more useful. Cortex and Palo's solutions do not have as much capability as Torq provides with the same tools. However, Torq's dashboards could be improved, especially on the case management side.

Read full review

Usman Bhatti

Senior Officer Security Operations Center at a financial services firm with 10,001+ employees

Simple deployment, scalable, but lacking third-party solution compatibility

Integrating IBM Resilient with other applications can be very difficult and technically challenging. Often, they use the excuse that you are using the latest version of an application, such as an endpoint security system, and they don't have an API or support for it at the moment. There is no automation in the SOAR solution. It's worth noting that many third-party add-on applications needed to be purchased separately to integrate with IBM Resilient. While there were built-in applications available for incident remediation, the selection was limited. Additionally, integrating third-party applications was often a difficult and time-consuming process due to the technical complexity involved.

Read full review

Rob Wille

Solutions Architect at a tech vendor with 201-500 employees

Creates value with advanced investigation capabilities while seeking improved integration with varied platforms

My primary improvement request would be for auxiliary logs, as they represent our biggest need. While we have automated deployments now, Microsoft Sentinel is fairly easy to deploy, although we face challenges with integrations related to AWS and GCP, particularly with Google. The integration challenges arise from both sides; Google tends to be noisy, and we find only ten analytic rules out of the box, necessitating the use of Defender for Cloud for alerts, which indicates a need for better documentation during deployment. The story between UEBA and Defender for Identity and Intra needs to be further explored and defined. There's some confusion on what is happening from a user and entity behavior.

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"As an analyst, it has demonstrated potential to reduce workforce requirements and time needed for related activities."

"The UBA, User Behavior Analytics, is very good."

"What I like most about IBM Resilient is that it has a complete stack, which means you don't need to use different OEM products because you have all you need under the IBM Resilient umbrella. You don't need to worry much about integrations and components because you're working with tested and proven architecture."

"The most valuable thing about it is how easy it is to navigate the user interface."

"The solution is easy to use."

"Its flexibility is the most valuable."

"It's really simple and has a flexible interface."

"The initial setup of IBM Resilient is not that complex since my company already has a support license that we use internally. In general, the product's deployment phase is not that complex."

"This is a good solution that we recommend for customers."

More IBM Resilient pros

"Sentinel has an intuitive, user-friendly way to visualize the data properly. It gives me a solid overview of all the logs. We get a more detailed view that I can't get from the other SIEM tools. It has some IP and URL-specific allow listing"

"I like the unified security console. You can close incidents using Sentinel in all other Microsoft Security portals, when it comes to incident response."

"Microsoft Sentinel does give me a unified set of tools to detect, investigate, and respond to incidents, and this unified approach is important to me because in today's world with numerous tools available, it's quite important."

"The native integration of the Microsoft security solution has been essential because it helps reduce some false positives, especially with some of the impossible travel rules that may be configured in Microsoft 365. For some organizations, that might be benign because they're using VPNs, etc."

"Microsoft Sentinel's ability to correlate data from multiple sources has improved our capability significantly."

"The most valuable feature is the UEBA. It's very easy for a security operations analyst. It has a one-touch analysis where you can search for a particular entity, and you can get a complete overview of that entity or user."

"The ability of Microsoft Sentinel to correlate data from multiple sources greatly helps our threat detection capabilities because correlation enables faster threat detection, even proactively."

"Investigations are something really remarkable. We can drill down right to the raw logs by running different queries and getting those on the console itself."

More Microsoft Sentinel pros

Cons

"It was able to capture data but was unable to differentiate between the agent hostname we are using and the hostname that resides on the back end of the Internet."

"There are shortcomings with IBM Resilient's technical support team that can be considered for improvement in the future."

"The ability to analyze incidents needs to be improved in the solution."

"The implementation could be a bit simpler."

"The integration could be improved so that it is easy to integrate with other solutions."

"The initial setup is complex."

"What could make IBM Resilient better is if IBM increased the number of built-in integrations with different products from other vendors or third-party products."

"The product must provide more integration with other tools."

"This product could be improved with better customization. This product isn't the best on the market like QRadar, but it's actually a good solution. However, some competitors' solutions contain more integration, support, automation, or flexibility."

More IBM Resilient cons

"There is a wider thing called Jupyter Notebooks, which is around the automation side of things. It would be good if there are playbooks that you can utilize without having to have the developer experience to do it in-house. Microsoft could provide more playbooks or more Jupyter Notebooks around MITRE ATT&CK Framework."

"Sentinel should be improved with more connectors. At the moment, it only covers a few vendors. If I remember correctly, only 100 products are supported natively in Sentinel, although you can connect them with syslog. But Microsoft should increase the number of native connectors to get logs into Sentinel."

"We've seen delays in getting the logs from third-party solutions and sometimes Microsoft products as well. It would be helpful if Microsoft created a list of the delays. That would make things more transparent for customers."

"They're giving us the queries so we can plug them right into Sentinel. They need to have a streamlined process for updating them in the tool and knowing when things are updated and knowing when there are new detections available from Microsoft."

"Our SIEM is only as good as the information we are ingesting. We are all human and we forget to ingest things."

"There is room for improvement in terms of integrations. We have some tools, such as our off-site Meraki firewalls, that have not fully integrated with Sentinel. We lack integration for Syslogs into Sentinel."

"Some of the data connectors are outdated, at least the ones that utilize Linux machines for log forwarding. I believe that Microsoft is already working on improving this."

"One key area that can be improved is by building a strong integration with our XDR platform."

More Microsoft Sentinel cons

Pricing and Cost Advice

Information not available

"There are no costs except for the support services that our company pays in addition to the licensing charges attached to the solution."

"The licensing cost for IBM Resilient is not too expensive, but it's not affordable, so it's moderately expensive. Regarding price, I'm rating the solution seven out of ten. The company pays for the license yearly, based on the number of users. Apart from the cost of the license you need to pay for each user, you also need to spend an initial investment for the base platform. You also have to pay for IBM Resilient support."

"We could create unlimited users using the license we had purchased."

"Pricing for the solution is good, in my opinion."

"The cost of the product is quite high."

"I feel it is an expensive product when my company pays annually for renewal, support, and follow-up."

"It is very expensive."

"I would rate the tool’s pricing a three out of ten. The tool’s pricing is on a yearly basis."

More IBM Resilient pricing and cost advice

"I am not involved on the financial side, but from an enterprise-wide use perspective, I think the price is good enough."

"We are charged based on the amount of data used, which can become expensive."

"It's costly to maintain and renew."

"The combination of the ease of accessibility and the free cost of the service is great. But we buy storage based on our events per second and on how many sources are integrated into the solution."

"It is kind of like a sliding scale. There are different tiers of pricing that go from $100 per day up to $3,500 per day. So, it just kind of depends on how much data is being stored. There can be additional costs to the standard license other than the additional data. It just kind of depends on what other services you're spinning up in Azure, or if you're using something like Azure log analytics."

"Microsoft Sentinel can be costly, particularly for data management."

"From a cost perspective, Microsoft Sentinel is quite costly."

"It is consumption-based pricing. It is an affordable solution."

More Microsoft Sentinel pricing and cost advice

See which vendors are best for you

Use our free recommendation engine to learn which Security Orchestration Automation and Response (SOAR) solutions are best for your needs.

See recommendations

879,889 professionals have used our research since 2012.

Top Industries

By visitors reading reviews

Financial Services Firm

15%

Computer Software Company

Manufacturing Company

Healthcare Company

Financial Services Firm

35%

Government

Computer Software Company

Comms Service Provider

Computer Software Company

14%

Financial Services Firm

10%

Manufacturing Company

Government

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

No data available

By reviewers
Company Size	Count
Small Business	9
Midsize Enterprise	2
Large Enterprise	7

By reviewers
Company Size	Count
Small Business	38
Midsize Enterprise	22
Large Enterprise	44

Questions from the Community

What needs improvement with Torq?

From our research and testing with the tool, we determined there need to be modifications and changes to train the LL...

See all answers

What is your primary use case for Torq?

I used Torq for conducting one of the proof of evaluations for a vendor we are connected with. I am currently working...

See all answers

What advice do you have for others considering Torq?

One of our members uses AWS, and we receive their feed. This involves triaging AWS-related logs. While I do not have ...

See all answers

What do you like most about IBM Resilient?

It is a stable solution...It is a scalable solution.

See all answers

What is your experience regarding pricing and costs for IBM Resilient?

I am not the one in charge of pricing, so I am not sure about the costs.

See all answers

What needs improvement with IBM Resilient?

Integration with some devices, including Cisco PowerPower and certain antivirus products, has limitations.

See all answers

Is there a common threat intelligence tool that aggregates multiple threat intelligence sources?

Yes, Azure Sentinel is a SIEM on the Cloud. Multiple data sources can be uploaded and analyzed with Azure Sentinel an...

See all answers

What is a better choice, Splunk or Azure Sentinel?

It would really depend on (1) which logs you need to ingest and (2) what are your use cases Splunk is easy for ingest...

See all answers

Which is better - Azure Sentinel or AWS Security Hub?

We like that Azure Sentinel does not require as much maintenance as legacy SIEMs that are on-premises. Azure Sentinel...

See all answers

Comparisons

Tines vs Torq

Compared 50% of the time

Splunk SOAR vs Torq

Compared 14% of the time

Blink Ops vs Torq

Compared 12% of the time

Palo Alto Networks Cortex XSOAR vs Torq

Compared 10% of the time

Swimlane vs Torq

Compared 7% of the time

More Torq Competitors

Palo Alto Networks Cortex XSOAR vs IBM Resilient

Compared 20% of the time

Splunk SOAR vs IBM Resilient

Compared 18% of the time

IBM Security QRadar vs IBM Resilient

Compared 10% of the time

SECDO Platform vs IBM Resilient

Compared 7% of the time

ThreatConnect Threat Intelligence Platform (TIP) vs IBM Resilient

Compared 5% of the time

More IBM Resilient Competitors

AWS Security Hub vs Microsoft Sentinel

Compared 17% of the time

Cortex XSIAM vs Microsoft Sentinel

Compared 6% of the time

IBM Security QRadar vs Microsoft Sentinel

Compared 5% of the time

Wazuh vs Microsoft Sentinel

Compared 4% of the time

CrowdStrike Falcon vs Microsoft Sentinel

Compared 4% of the time

More Microsoft Sentinel Competitors

Product Reports

Buyer's Guide

Security Orchestration Automation and Response (SOAR)

December 2025

Download Torq product report

Buyer's Guide

IBM Resilient

December 2025

Download IBM Resilient product report

Buyer's Guide

Microsoft Sentinel

December 2025

Download Microsoft Sentinel product report

Also Known As

No data available

Azure Sentinel

Overview

Torq provides advanced automation capabilities, enabling organizations to streamline operations and enhance efficiency. It's designed to address complex workflows, reducing manual efforts and improving productivity.

Leveraging automation, Torq assists companies in managing intricate processes with agility and precision, making it indispensable for those seeking to optimize their workflows. Its robust platform integrates smoothly into current infrastructures, minimizing disruptions while enhancing operational capacities.

What are Torq's standout features?

Automation Workflows: Streamlines repetitive tasks to enhance efficiency.
Seamless Integration: Connects with existing systems effortlessly.
Scalability: Adapts to growing business demands efficiently.

What benefits should you look for in reviews?

Productivity Gains: Significant improvement in task completion rates.
Cost Reduction: Decreases manual labor costs through automation.
Enhanced Collaboration: Facilitates better communication among teams.

Torq's capabilities are especially beneficial in industries like finance and healthcare where intricate workflows and compliance requirements are common. Automation in these sectors supports better data management and regulatory adherence, providing a decisive edge in operational efficiency.

Torq

The Resilient Incident Response Platform (IRP) is the leading platform for orchestrating and automating incident response processes.

The Resilient IRP quickly and easily integrates with your organization’s existing security and IT investments. It makes security alerts instantly actionable, provides valuable intelligence and incident context, and enables adaptive response to complex cyber threats.

IBM

Microsoft Sentinel is a scalable, cloud-native, security information event management (SIEM) and security orchestration automated response (SOAR) solution that lets you see and stop threats before they cause harm. Microsoft Sentinel delivers intelligent security analytics and threat intelligence across the enterprise, providing a single solution for alert detection, threat visibility, proactive hunting, and threat response. Eliminate security infrastructure setup and maintenance, and elastically scale to meet your security needs—while reducing IT costs. With Microsoft Sentinel, you can:

- Collect data at cloud scale—across all users, devices, applications, and infrastructure, both on-premises and in multiple clouds

- Detect previously uncovered threats and minimize false positives using analytics and unparalleled threat intelligence from Microsoft

- Investigate threats with AI and hunt suspicious activities at scale, tapping into decades of cybersecurity work at Microsoft

- Respond to incidents rapidly with built-in orchestration and automation of common tasks

To learn more about our solution, ask questions, and share feedback, join our Microsoft Security, Compliance and Identity Community.

Microsoft

Sample Customers

Information Not Available

Golden Living, Health Equity, USA Funds

Microsoft Sentinel is trusted by companies of all sizes including ABM, ASOS, Uniper, First West Credit Union, Avanade, and more.

Buyer's Guide

IBM Resilient vs. Microsoft Sentinel

December 2025

Free Report: IBM Resilient vs. Microsoft Sentinel

Find out what your peers are saying about IBM Resilient vs. Microsoft Sentinel and other solutions. Updated: December 2025.

DOWNLOAD NOW

879,889 professionals have used our research since 2012.

See our IBM Resilient vs. Microsoft Sentinel report.

See our list of best Security Orchestration Automation and Response (SOAR) vendors.

We monitor all Security Orchestration Automation and Response (SOAR) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.