Microsoft Sentinel vs Sumo Logic Security comparison

Microsoft and Sumo Logic are both solutions in the Security Information and Event Management (SIEM) category. Microsoft is ranked #2 with an average rating of 8.4, while Sumo Logic is ranked #19 with an average rating of 8.3. Microsoft holds a 10.8% mindshare in SIEM, compared to Sumo Logic’s 0.8% mindshare. Additionally, 93% of Microsoft users are willing to recommend the solution, compared to 95% of Sumo Logic users who would recommend it.

Microsoft Sentinel

Read 89 Microsoft Sentinel reviews

23,840 Views
13,739 Comparison Views

93% willing to recommend

Sumo Logic Security

Read 18 Sumo Logic Security reviews

1,626 Views
1,104 Comparison Views

95% willing to recommend

Microsoft Sentinel

Sumo Logic Security

Comparison Buyer's Guide

Download the report

Executive SummaryUpdated on Sep 18, 2024

Sumo Logic Security and Microsoft Sentinel are competitors in the security data and analytics sector. Sumo Logic Security excels in deployment ease and customer support, while Microsoft Sentinel stands out due to its advanced features and AI capabilities.

Features: Sumo Logic Security offers real-time analytics, scalability, and integration capabilities. Its search and alert features are user-friendly. Microsoft Sentinel provides comprehensive threat detection, AI-driven insights, and seamless integration with other Microsoft products. The primary distinction lies in Sentinel's advanced AI versus Sumo Logic's real-time analytics.

Room for Improvement: Sumo Logic Security needs enhanced multi-cloud compatibility and more detailed documentation. Microsoft Sentinel could improve in alert management and customization options. Both products have distinct areas for enhancement, with varying focus points.

Ease of Deployment and Customer Service: Sumo Logic Security is known for its easy deployment process and responsive customer service. Microsoft Sentinel, despite its complexity in deployment due to robust features, benefits from excellent integration with other Microsoft services, aiding existing Microsoft users. Sumo Logic Security scores highly for deployment and customer support, while Microsoft Sentinel's integration within the Microsoft ecosystem helps balance its complexity.

Pricing and ROI: Sumo Logic Security is valued for competitive pricing and clear ROI, particularly for SMBs. Microsoft Sentinel, potentially more expensive, offers significant ROI through its advanced features and integration capabilities. Users see the higher initial Sentinel cost as justified by long-term benefits and superior features.

To learn more, read our detailed Microsoft Sentinel vs. Sumo Logic Security Report (Updated: October 2024).

Buyer's Guide

Microsoft Sentinel vs. Sumo Logic Security

October 2024

Download the complete report

Helped 814,649 peers since 2012

Categories and Ranking

Microsoft Sentinel

Ranking in Security Information and Event Management (SIEM)

2nd

Ranking in Security Orchestration Automation and Response (SOAR)

1st

Average Rating

8.2

Reviews Sentiment

7.1

Number of Reviews

Ranking in other categories

Microsoft Security Suite (5th)

Sumo Logic Security

Ranking in Security Information and Event Management (SIEM)

19th

Ranking in Security Orchestration Automation and Response (SOAR)

12th

Average Rating

8.6

Number of Reviews

Ranking in other categories

Log Management (19th)

Mindshare comparison

As of November 2024, in the Security Information and Event Management (SIEM) category, the mindshare of Microsoft Sentinel is 10.8%, down from 12.8% compared to the previous year. The mindshare of Sumo Logic Security is 0.8%, down from 1.0% compared to the previous year. It is calculated based on PeerSpot user engagement data.

Security Information and Event Management (SIEM)

Featured Reviews

Nitin Arora

Security Delivery Senior Analyst at Accenture

Nov 2, 2022

Gives us one place to investigate and respond to threats, and automation eliminates manual work

They can work on the EDR side of things. It is already really superb, because of the kinds of features we get with the EDR solution. It's not a standard EDR and they have recently enhanced things. But the problem is with onboarding devices. I have different OS flavors, including a large number of Linux, Windows, macOS, and some on-prem machines as well. Every time we need to onboard these kinds of machines into the EDR, we need to do it with the help of Intune, to sync up the devices, and do the configuration. I'm looking for something on the EDR side that will reduce this kind of work. They can eliminate having to do manual configuration for the machines, and check the different types of configurations for each OS. In some cases, it does not support some OSs. If they could reduce this type of work, that would be really amazing.

Read full review

Moole Muralidhara Reddy

DevOps and Solution Architect at ADP

Mar 26, 2024

Used to store and monitor application logs and VPC flow logs

We are mainly concentrating on networking. We use VPC products and application logs to monitor the genuineness of users who have logged in. We also store and monitor GuardDuty logs to see if someone is trying to access the same server multiple times. We are storing and monitoring WAF logs and GuardDuty logs. If someone faces any issues, we'll receive an email and take action based on it. If someone tries to access one of the applications from a different country, we can search in Google and identify the location of that particular IP address. Sumo Logic Security identifies whether a particular IP address is low, medium, or high risk without the help of Google. We can store logs in CloudWatch, but it is very difficult to search them in CloudWatch. We should know the query in order to do that. Searching for logs with Sumo Logic Security is very easy compared to CloudWatch. We have been using the solution for more than two years and haven't faced any issues with the solution's availability. I would recommend the solution to other users. I would recommend Sumo Logic Security instead of AWS, CloudWatch, or CloudTrail. With Sumo Logic Security, you can capture and see all the logs in a single place. If some issues occur, you can log into the solution and verify all the logs. At an organizational level, we have multiple AWS accounts for different environments. Instead of logging in to all the AWS accounts, you can log in to Sumo Logic Security and verify everything. Overall, I rate the solution a nine out of ten.

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"The in-built SOAR of Sentinel is valuable. Kusto Query Language is also valuable for the ease of writing queries and ease of getting insights from the logs. Schedule-based queries within Sentinel are also valuable. I found these three features most useful for my projects."

"The most valuable feature is the onboarding of the workloads. You can see all that has been onboarded in your account on the dashboards."

"It is easy to implement (turn on) - does need a skilled analyst to develop queries and playbooks."

"The AI capability is one of the main features of the solution because I believe that in the market, there are few solutions that are providing security solutions based on AI and machine learning."

"The log query feature has been the most valuable because it's very good. You can put your data on the cloud and run queues from Sentinel. It will do it all very fast. I love that I don't have to upload it to an Excel file and then manually look for a piece of information. Sentinel is much faster and is good for big databases."

"The solution offers a lot of data on events. It helps us create specific detection strategies."

"Sentinel improved how we investigate incidents. We can create watchlists and update them to align with the latest threat intelligence. The information Microsoft provides enables us to understand thoroughly and improve as we go along. It allows us to provide monthly reports to our clients on their security posture."

"The query language of Microsoft Sentinel is easy to understand and use."

More Microsoft Sentinel pros

"With this tool, we provide access to every developer team the ability to find errors, then they come to us and ask for specific help."

"We use it to ingest Windows domain controller logs. We use this to monitor if anyone is placed in particular administration groups that potentially shouldn't be. It helps us keep track of people."

"I have no concerns about the stability of the product. I feel it handles the stress we put on it very well."

"Sumo Logic Security is a good solution for searching the logs and identifying the issues."

"Technical support is always great."

"Scalability has been good for our needs. We haven't run into any scaling issues in regards to size so far."

"It helps a lot because we can troubleshoot issues pretty easily."

"For many of our services, we use Sumo Logic to track errors and send notifications to our Slack channel, if there are issues. Then, we have our support people monitoring this, and they can react quickly."

More Sumo Logic Security pros

Cons

"It would be good to have some connectors for third-party SIEM solutions. Many customers are struggling with the integration of Azure Sentinel with their on-premise SIEM. Microsoft is changing the log structure many times a year, which can corrupt a custom integration. It would be good to have some connectors developed by Microsoft or supply vendors, but they are not providing such functionality or tools."

"While I appreciate the UI itself and the vast amount of information available on the platform, I'm finding the overall user experience to be frustrating due to frequent disconnections and the requirement to repeatedly re-authenticate."

"We're satisfied with the comprehensiveness of the security protection. That said, we do have issues sometimes where there have been global outages and we need to raise a ticket with Microsoft."

"The pricing could be improved."

"I would like to be able to monitor applications outside of the Azure Cloud."

"The performance could be improved. If I create 15 to 20 lines for a single-use case in KQL, sometimes it takes more time to execute. If I create use cases within a certain timeline, the result will show in .01 seconds. A complex query takes more time to get results."

"The interface could be more user-friendly. It''s a small improvement that they could make if they wanted to."

"I believe one of the challenges I encountered was the absence of live training sessions, even with the option to pay for them."

More Microsoft Sentinel cons

"The API integration in Sumo Logic Security could improve. There are delayed connections or they stop and then automatically start. Having a seamless log collection would be beneficial."

"In my opinion, this solution has a steep learning curve and requires practice if users to be able to use this tool very efficiently."

"There needs to be improvement on imported data which can be used within Sumo Logic to do more advanced queries."

"From the network segmentation side, there is some discrepancy in log onboarding. The tool needs to improve direct API integrations, login integration, native login integration, etc."

"The solution should improve its UI."

"There are some API gaps that are missing."

"Sumo Logic Security is expensive, and its pricing could be improved."

"The initial setup is the most stressful, like learning how to use it."

More Sumo Logic Security cons

Pricing and Cost Advice

"Sentinel's pricing is on the higher side, but you can get a discount if you can predict your usage. You have to pay ingestion and storage fees. There are also fees for Logic Apps and particular features. It seems heavily focused on microtransactions, but they may be slightly optional. By contrast, Splunk requires no additional fee for their equivalent of Logic. You have a little more flexibility, but Sentinel's costs add up."

"The pricing is fair... With a traditional SIEM, you pay a lump sum for licenses. But with Sentinel, it's pay-as-you-go according to the amount of data you inject."

"Microsoft is costlier. Some organizations may not be able to afford the cost of Sentinel orchestration and the Log Analytics workspace. The transaction hosting cost is also a little bit on the high side, compared to AWS and GCP."

"We are charged based on the amount of data used, which can become expensive."

"The pricing is based on how much you ingest, so it's pretty straightforward. There are no tiers, and you pay for what you use unlike with other types of SIEM solutions that are usually based on tiers."

"Sentinel is expensive relative to other products of the class, so it often isn't affordable for small-scale businesses. However, considering the solution has more extensive capabilities than others, the price is not so high. Pricing is based on GBs of ingested daily data, either by a pay-as-you-go or subscription model."

"Sentinel is a pay-as-you-go solution. To use it, you need a Log Analytics workspace. This is where the logs are stored and the cost of Log Analytics is based on gigabytes... On top of that, there is the cost of Sentinel, which is about €2 per gigabyte. If a customer has an M365 E5 license, the logs that come from Microsoft Defender are free."

"The cost of Sentinel is high. It typically costs more than $100 for five to ten users of the licenses or subscriptions. It costs around $123 per day on the cloud. Small- to mid-sized organizations would need a dedicated budget to adopt this solution; however, the cost may not be an issue for large, enterprise-level organizations."

More Microsoft Sentinel pricing and cost advice

"If we went to ELK Stack, which is open source, it would have been less costly, but it would have required more development from our side."

"The license pricing model is based on the events that are processed through the solution."

"The price scaling comes in a bit expensive."

"The only limit to the scalability of the product for us is how much we are willing to pay."

"The pricing is good. It's not an issue for us."

"The pricing is a little high, but for the features that we receive from Sumo Logic, it suits the price. For some small organizations, the price might be a little high."

"Storing logs in Sumo Logic Security is charged GB-wise, which is a little higher than other products."

"Pricing has been cheaper than some of the competing tools, like Splunk."

More Sumo Logic Security pricing and cost advice

See which vendors are best for you

Use our free recommendation engine to learn which Security Information and Event Management (SIEM) solutions are best for your needs.

See recommendations

814,649 professionals have used our research since 2012.

Top Industries

By visitors reading reviews

Computer Software Company

16%

Financial Services Firm

10%

Government

Manufacturing Company

Computer Software Company

16%

Financial Services Firm

11%

Government

10%

Manufacturing Company

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

Questions from the Community

Is there a common threat intelligence tool that aggregates multiple threat intelligence sources?

Yes, Azure Sentinel is a SIEM on the Cloud. Multiple data sources can be uploaded and analyzed with Azure Sentinel and its Threat Hunting functionality with AI available as templates or customized ...

See all answers

What is a better choice, Splunk or Azure Sentinel?

It would really depend on (1) which logs you need to ingest and (2) what are your use cases Splunk is easy for ingestion of anything, but the charge per GB/Day Indexed and it gets expensive as log ...

See all answers

Which is better - Azure Sentinel or AWS Security Hub?

We like that Azure Sentinel does not require as much maintenance as legacy SIEMs that are on-premises. Azure Sentinel is auto-scaling - you will not have to worry about performance impact, you will...

See all answers

What do you like most about Sumo Logic Security?

Sumo Logic Security is a good solution for searching the logs and identifying the issues.

See all answers

What is your experience regarding pricing and costs for Sumo Logic Security?

Storing logs in Sumo Logic Security is charged GB-wise, which is a little higher than other products.

See all answers

What needs improvement with Sumo Logic Security?

Sumo Logic Security is expensive, and its pricing could be improved.

See all answers

Comparisons

AWS Security Hub vs Microsoft Sentinel

Compared 20% of the time

IBM Security QRadar vs Microsoft Sentinel

Compared 10% of the time

Cortex XSIAM vs Microsoft Sentinel

Compared 7% of the time

Wazuh vs Microsoft Sentinel

Compared 6% of the time

Google Chronicle Suite vs Microsoft Sentinel

Compared 5% of the time

More Microsoft Sentinel Competitors

Google Chronicle Suite vs Sumo Logic Security

Compared 15% of the time

Wazuh vs Sumo Logic Security

Compared 13% of the time

Rapid7 InsightIDR vs Sumo Logic Security

Compared 11% of the time

Securonix Next-Gen SIEM vs Sumo Logic Security

Compared 8% of the time

Splunk Enterprise Security vs Sumo Logic Security

Compared 7% of the time

More Sumo Logic Security Competitors

Product Reports

Buyer's Guide

Microsoft Sentinel

October 2024

Download Microsoft Sentinel product report

Buyer's Guide

Sumo Logic Security

October 2024

Download Sumo Logic Security product report

Also Known As

Azure Sentinel

No data available

Learn More

Microsoft

Sumo Logic

Overview

Microsoft Sentinel is a scalable, cloud-native, security information event management (SIEM) and security orchestration automated response (SOAR) solution that lets you see and stop threats before they cause harm. Microsoft Sentinel delivers intelligent security analytics and threat intelligence across the enterprise, providing a single solution for alert detection, threat visibility, proactive hunting, and threat response. Eliminate security infrastructure setup and maintenance, and elastically scale to meet your security needs—while reducing IT costs. With Microsoft Sentinel, you can:

- Collect data at cloud scale—across all users, devices, applications, and infrastructure, both on-premises and in multiple clouds

- Detect previously uncovered threats and minimize false positives using analytics and unparalleled threat intelligence from Microsoft

- Investigate threats with AI and hunt suspicious activities at scale, tapping into decades of cybersecurity work at Microsoft

- Respond to incidents rapidly with built-in orchestration and automation of common tasks

To learn more about our solution, ask questions, and share feedback, join our Microsoft Security, Compliance and Identity Community.

Sumo Logic

Sumo Logic is a cloud-based machine data analytics company focusing on security, operations, and BI use cases. It provides log management and analytics services that leverage machine-generated big data to deliver real-time IT insights.

Sumo Logic is developed as a SaaS solution, it processes and analyzes large quantities of IT infrastructure data, spotting patterns and anomalies that can indicate a potential threat or significant event.

The platform is designed to help IT, security, and business operations teams develop, manage, and secure their applications and cloud infrastructures. It collects, aggregates, and analyzes data from various sources including servers, virtual machines, and network devices, providing visibility into complex systems.

What are the key features of Sumo Logic?

Real-time Analytics: Continuous queries and live dashboards that provide insights into application performance, user behavior, and security threats.
Advanced Machine Learning: Utilizes machine learning algorithms to identify trends, anomalies, and patterns.
Integrated Threat Intelligence: Tools and workflows to enhance security postures by detecting threats and anomalies.
Multi-tenant Cloud Service: Allows users to operate in a shared cloud environment securely.

The solution aims to simplify data complexity, streamline operations, and provide actionable insights to businesses across various industries.

Sumo Logic is designed to handle high data volumes from multiple sources without diminishing performance. It is primarily deployed in the cloud with seamless integrations for AWS, Google Cloud, and Microsoft Azure. This flexibility allows users to leverage Sumo Logic’s capabilities regardless of their existing cloud infrastructure.

In summary, Sumo Logic is a comprehensive, AI-driven analytics solution ideal for businesses looking to enhance their IT and security operations through data-driven insights and real-time monitoring. Its flexible deployment options and scalable pricing model make it accessible for various business sizes and sectors.

Sample Customers

Microsoft Sentinel is trusted by companies of all sizes including ABM, ASOS, Uniper, First West Credit Union, Avanade, and more.

Information Not Available

Buyer's Guide

Microsoft Sentinel vs. Sumo Logic Security

October 2024

Free Report: Microsoft Sentinel vs. Sumo Logic Security

Find out what your peers are saying about Microsoft Sentinel vs. Sumo Logic Security and other solutions. Updated: October 2024.

DOWNLOAD NOW

814,649 professionals have used our research since 2012.

See our Microsoft Sentinel vs. Sumo Logic Security report.

See our list of best Security Information and Event Management (SIEM) vendors, best Security Orchestration Automation and Response (SOAR) vendors, and best Security Information and Event Management (SIEM) vendors.

We monitor all Security Information and Event Management (SIEM) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.