Microsoft Sentinel vs Trellix Helix comparison

Microsoft and Trellix are both solutions in the Security Information and Event Management (SIEM) category. Microsoft is ranked #3 with an average rating of 8.4, while Trellix is ranked #31 with an average rating of 9.0. Microsoft holds a 8.7% mindshare in SIEM, compared to Trellix’s 0.5% mindshare. Additionally, 93% of Microsoft users are willing to recommend the solution, compared to 100% of Trellix users who would recommend it.

Microsoft Sentinel

Read 89 Microsoft Sentinel reviews

16,740 Views
9,816 Comparison Views

93% willing to recommend

Trellix Helix

Read 10 Trellix Helix reviews

1,034 Views
694 Comparison Views

100% willing to recommend

Microsoft Sentinel

Trellix Helix

Comparison Buyer's Guide

Download the report

Executive SummaryUpdated on Sep 18, 2024

Trellix Helix and Microsoft Sentinel are competing security information and event management (SIEM) products. Users are happier with the pricing and support of Trellix Helix, but Microsoft Sentinel seems to be a superior product due to its features.

Features: Trellix Helix users value its robust integration capabilities, advanced threat detection, and straightforward deployment. Microsoft Sentinel users appreciate its scalability, comprehensive analytics, and seamless integration with other Microsoft products.

Room for Improvement: Trellix Helix users suggest better documentation, more efficient query performance, and improvements in alert management. Microsoft Sentinel users mention needing a more intuitive configuration process, enhancements in alert management, and faster support response.

Ease of Deployment and Customer Service: Trellix Helix is praised for its straightforward deployment and responsive customer service. Microsoft Sentinel is noted for its seamless integration with other Microsoft products but sometimes lacks immediate customer service responses.

Pricing and ROI: Trellix Helix users feel it offers good value for the cost with favorable ROI. Microsoft Sentinel is considered more expensive but justifiable due to its extensive features and strong ROI.

To learn more, read our detailed Microsoft Sentinel vs. Trellix Helix Report (Updated: December 2024).

Buyer's Guide

Microsoft Sentinel vs. Trellix Helix

December 2024

Download the complete report

Helped 824,052 peers since 2012

Categories and Ranking

Microsoft Sentinel

Ranking in Security Information and Event Management (SIEM)

3rd

Average Rating

8.2

Reviews Sentiment

7.1

Number of Reviews

Ranking in other categories

Security Orchestration Automation and Response (SOAR) (1st), Microsoft Security Suite (5th), AI-Powered Cybersecurity Platforms (5th)

Trellix Helix

Ranking in Security Information and Event Management (SIEM)

31st

Average Rating

8.8

Reviews Sentiment

7.3

Number of Reviews

Ranking in other categories

Security Incident Response (7th)

Mindshare comparison

As of December 2024, in the Security Information and Event Management (SIEM) category, the mindshare of Microsoft Sentinel is 8.7%, down from 10.4% compared to the previous year. The mindshare of Trellix Helix is 0.5%, down from 0.8% compared to the previous year. It is calculated based on PeerSpot user engagement data.

Security Information and Event Management (SIEM)

Featured Reviews

Nitin Arora

Security Delivery Senior Analyst at Accenture

Gives us one place to investigate and respond to threats, and automation eliminates manual work

They can work on the EDR side of things. It is already really superb, because of the kinds of features we get with the EDR solution. It's not a standard EDR and they have recently enhanced things. But the problem is with onboarding devices. I have different OS flavors, including a large number of Linux, Windows, macOS, and some on-prem machines as well. Every time we need to onboard these kinds of machines into the EDR, we need to do it with the help of Intune, to sync up the devices, and do the configuration. I'm looking for something on the EDR side that will reduce this kind of work. They can eliminate having to do manual configuration for the machines, and check the different types of configurations for each OS. In some cases, it does not support some OSs. If they could reduce this type of work, that would be really amazing.

Read full review

Abanoub Alfy

Information Technology Security Analyst at EBC

Helps prevent email attacks, like phishing and email spoofing attacks

We use Trellix Helix for protection against network attacks, TLS, and SSL attacks. We also use the solution for user behaviour accesses Trellix Helix helps prevent email attacks, like phishing and email spoofing attacks. Trellix Helix's configuration and learning could be improved to identify…

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"The SOAR playbooks are Sentinel's most valuable feature. It gives you a unified toolset for detecting, investigating, and responding to incidents. That's what clearly differentiates Sentinels from its competitors. It's cloud-native, offering end-to-end coverage with more than 120 connectors. All types of data logs can be poured into the system so analysis can happen. That end-to-end visibility gives it the advantage."

"The most valuable feature is the UEBA. It's very easy for a security operations analyst. It has a one-touch analysis where you can search for a particular entity, and you can get a complete overview of that entity or user."

"Sentinel has features that have helped improve our security poster. It helped us in going ahead and identifying the gaps via analysis and focusing on the key elements."

"It's pretty powerful and its performance is pretty good."

"The most valuable feature is the alert notifications, which are categorized by severity levels: informational, low, medium, and high."

"The solution has features that helped improve the security posture of our clients. It provides the ability to correlate a large variety of log sources very cost-effectively, especially for Microsoft sources."

"The analytic rule is the most valuable feature."

"The most valuable features are its threat handling and detection. It's a powerful tool because it's based on machine learning and on the behavior of malware."

More Microsoft Sentinel pros

"I like that it's easy. It's got the protection set up, and we can see whatever is required. We write our own rules and the rules that we can input. I think it is good."

"FireEye Helix's best features are its speed and use of an easy-to-understand language to send queries to the raw logs."

"The product offers very strong automation. Our cyber security analysts don't have to correlate the information to detect problems. They only need to analyze problems that have been identified by the platform."

"The integration is very useful and very easy. You can have an API connection with any cloud and I'll be able to do both ways of communication with the help of APA."

"Trellix Helix helps prevent email attacks, like phishing and email spoofing attacks."

"We are able to block some advanced malware and other things."

"The most valuable features include predefined use cases and threatening states."

"It is kind of simple and very easily deployable. You can start working with it very fast."

More Trellix Helix pros

Cons

"I think the number one area of improvement for Sentinel would be the cost."

"We've seen delays in getting the logs from third-party solutions and sometimes Microsoft products as well. It would be helpful if Microsoft created a list of the delays. That would make things more transparent for customers."

"The built-in SOAR is not really good out-of-the-box. The SOAR relies on logic apps and you almost need to have some kind of developer background to be able to make these logic apps. Most security people cannot develop anything..."

"There is room for improvement in terms of integrations."

"Improvement-wise, I would like to see more integration with third-party solutions or old-school antivirus products that have some kind of logging capability. I wouldn't mind having that exposed within Sentinel. We do have situations where certain companies have bought licensing or have made an investment in a product, and that product will be there for the next two or three years. To be able to view information from those legacy products would be great. We can then better leverage the Sentinel solution and its capabilities."

"At the network level, there is a limitation in integrating some of the switches or routers with Microsoft Sentinel. Currently, SPAN traffic monitoring is not available in Microsoft Sentinel. I have heard that it is available in Defender for Identity, which is a different product. It would be good if LAN traffic monitoring or SPAN traffic monitoring is available in Microsoft Sentinel. It would add a lot of value. It is available in some of the competitor products in the market."

"There is a wider thing called Jupyter Notebooks, which is around the automation side of things. It would be good if there are playbooks that you can utilize without having to have the developer experience to do it in-house. Microsoft could provide more playbooks or more Jupyter Notebooks around MITRE ATT&CK Framework."

"The learning curve could be improved. I am still learning it. We were able to implement the basic features to get them up and running, but there are still so many things that I don't know about all its features. They have a lot of features that we have not been able to use or apply. If they could work on reducing the solution's learning curve, that would be good. While there is a training course held by Microsoft to learn more about this solution, there is a cost associated with it."

More Microsoft Sentinel cons

"There is room for improvement in the integration capabilities of third-party tools."

"Sometimes the rules are disabled by FireEye, and we basically get it after the patch. I think there needs to be a better way of creating the application rules. I would like to see better pricing for our licensing."

"Trellix needs to address the price for the product to be more appealing to customers."

"It should have more cloud connectors. It could also be cheaper."

"Trellix Helix's configuration and learning could be improved to identify normal traffic from abnormal and to identify trusted domains."

"Integrations could be improved, and the dashboard could be a little better."

"The graphical user interface could be improved. It's not easy to handle and it's not easy for a customer or end-user to learn how to manage the solution."

"FireEye Helix would be improved with the option of an on-prem version, which they don't currently offer."

More Trellix Helix cons

Pricing and Cost Advice

"It is certainly the most expensive solution. The cost is very high. We need to do an assessment using the one-month trial so that we can study the cost side. Before implementing it, we must do a careful calculation."

"The pricing is reasonable, and we think Sentinel is worth what we pay for it."

"Sentinel is costly."

"Good monthly operational cost model for the detection and response outcomes delivered, M365 logs don't count toward the limits which is a good benefit."

"Sentinel's price is comparable to pretty much everything out there. None of it is cheap, but we didn't think we could save money by going a different route. Sentinel was part of our Azure expenditures, so it was easier to add the expense instead of having a completely separate vendor."

"Sentinel is fairly priced and pretty cost-effective."

"The pricing isn't very high. It depends on the number of logs you have. If you're expecting to ingest 50 to 60G in a day, but you're only ingesting 20 to 25G per day at first and you have a good team to analyze the logs, then you can segregate the ingestion at under 15G."

"Sentinel is costly compared to other solutions, but it's fair. SIEM solutions like CrowdStrike charge based on daily log volume. They generally process a set number of logs for free before they start charging. Microsoft's pricing is clearer. It's free under five gigabytes. Some of these logs we ingest have a cost, so they don't hide it. I believe the tenant pays the price, and Microsoft helps create awareness of the cost."

More Microsoft Sentinel pricing and cost advice

"It could be cheaper, but that applies to every product."

"FireEye Helix is a little expensive."

"The price could be better. But I think it's rightly placed when we buy everything in one shot, and we get some discount for that. That's how we basically plan our deployment, and it's holistic. We pay for the license yearly."

"I rate Trellix Helix a five out of ten for pricing."

See which vendors are best for you

Use our free recommendation engine to learn which Security Information and Event Management (SIEM) solutions are best for your needs.

See recommendations

824,052 professionals have used our research since 2012.

Top Industries

By visitors reading reviews

Computer Software Company

16%

Financial Services Firm

10%

Government

Manufacturing Company

Computer Software Company

17%

Comms Service Provider

13%

Manufacturing Company

12%

Financial Services Firm

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

Questions from the Community

Is there a common threat intelligence tool that aggregates multiple threat intelligence sources?

Yes, Azure Sentinel is a SIEM on the Cloud. Multiple data sources can be uploaded and analyzed with Azure Sentinel and its Threat Hunting functionality with AI available as templates or customized ...

See all answers

What is a better choice, Splunk or Azure Sentinel?

It would really depend on (1) which logs you need to ingest and (2) what are your use cases Splunk is easy for ingestion of anything, but the charge per GB/Day Indexed and it gets expensive as log ...

See all answers

Which is better - Azure Sentinel or AWS Security Hub?

We like that Azure Sentinel does not require as much maintenance as legacy SIEMs that are on-premises. Azure Sentinel is auto-scaling - you will not have to worry about performance impact, you will...

See all answers

What do you like most about FireEye Helix?

Trellix Helix helps prevent email attacks, like phishing and email spoofing attacks.

See all answers

What is your experience regarding pricing and costs for FireEye Helix?

The pricing is reasonable compared to its competitors.

See all answers

What needs improvement with FireEye Helix?

There is room for improvement in the integration capabilities of third-party tools. It has no problem connecting all solutions to Helix. Right now, we only connect one of Trellix's appliances to th...

See all answers

Comparisons

AWS Security Hub vs Microsoft Sentinel

Compared 21% of the time

IBM Security QRadar vs Microsoft Sentinel

Compared 10% of the time

Cortex XSIAM vs Microsoft Sentinel

Compared 7% of the time

Wazuh vs Microsoft Sentinel

Compared 6% of the time

Google Chronicle Suite vs Microsoft Sentinel

Compared 5% of the time

More Microsoft Sentinel Competitors

Splunk Enterprise Security vs Trellix Helix

Compared 31% of the time

Trellix ESM vs Trellix Helix

Compared 16% of the time

LogRhythm SIEM vs Trellix Helix

Compared 11% of the time

Fortinet FortiSIEM vs Trellix Helix

Compared 11% of the time

Palo Alto Networks Cortex XSOAR vs Trellix Helix

Compared 9% of the time

More Trellix Helix Competitors

Product Reports

Buyer's Guide

Microsoft Sentinel

November 2024

Download Microsoft Sentinel product report

Buyer's Guide

Trellix Helix

November 2024

Download Trellix Helix product report

Also Known As

Azure Sentinel

FireEye Helix, FireEye Threat Analytics

Learn More

Microsoft

Video not available

Trellix

Overview

Microsoft Sentinel is a scalable, cloud-native, security information event management (SIEM) and security orchestration automated response (SOAR) solution that lets you see and stop threats before they cause harm. Microsoft Sentinel delivers intelligent security analytics and threat intelligence across the enterprise, providing a single solution for alert detection, threat visibility, proactive hunting, and threat response. Eliminate security infrastructure setup and maintenance, and elastically scale to meet your security needs—while reducing IT costs. With Microsoft Sentinel, you can:

- Collect data at cloud scale—across all users, devices, applications, and infrastructure, both on-premises and in multiple clouds

- Detect previously uncovered threats and minimize false positives using analytics and unparalleled threat intelligence from Microsoft

- Investigate threats with AI and hunt suspicious activities at scale, tapping into decades of cybersecurity work at Microsoft

- Respond to incidents rapidly with built-in orchestration and automation of common tasks

To learn more about our solution, ask questions, and share feedback, join our Microsoft Security, Compliance and Identity Community.

Trellix Helix is a cutting-edge product that revolutionizes the way businesses manage their data and streamline their operations. With its advanced features and user-friendly interface, Trellix Helix offers a comprehensive solution for businesses of all sizes. One of the key features of Trellix Helix is its powerful data management capabilities.

The product allows businesses to store, organize, and analyze large volumes of data in a secure and efficient manner. With its intuitive interface, users can easily navigate through the system and access the information they need, saving valuable time and effort. Trellix Helix also offers seamless integration with other business applications, making it a versatile tool for businesses. It can be easily integrated with existing systems, such as CRM and ERP software, allowing for a smooth flow of data across different platforms. This integration ensures that businesses have a holistic view of their operations and can make informed decisions based on accurate and up-to-date information.

Another standout feature of Trellix Helix is its robust reporting and analytics capabilities. It provides businesses with real-time insights and actionable intelligence, enabling them to identify trends, spot opportunities, and make data-driven decisions. The customizable dashboards and reports allow users to visualize data in a meaningful way, making it easier to understand complex information and communicate it effectively to stakeholders.

Trellix Helix offers advanced security features to protect sensitive business data. It employs industry-standard encryption protocols and access controls to ensure that data is secure and only accessible to authorized personnel. This level of security gives businesses peace of mind, knowing that their valuable information is protected from unauthorized access or breaches.

Helix is a comprehensive and user-friendly solution for businesses looking to optimize their data management and streamline their operations. With its advanced features, seamless integration, robust reporting, and analytics capabilities, as well as top-notch security, Trellix Helix empowers businesses to make informed decisions, improve efficiency, and drive growth.

Sample Customers

Microsoft Sentinel is trusted by companies of all sizes including ABM, ASOS, Uniper, First West Credit Union, Avanade, and more.

Police Bank, Verisk Analytics, Teck Resources

Buyer's Guide

Microsoft Sentinel vs. Trellix Helix

December 2024

Free Report: Microsoft Sentinel vs. Trellix Helix

Find out what your peers are saying about Microsoft Sentinel vs. Trellix Helix and other solutions. Updated: December 2024.

DOWNLOAD NOW

824,052 professionals have used our research since 2012.

See our Microsoft Sentinel vs. Trellix Helix report.

See our list of best Security Information and Event Management (SIEM) vendors.

We monitor all Security Information and Event Management (SIEM) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.