Microsoft Sentinel vs Trellix Helix comparison

Microsoft and Trellix are both solutions in the Security Information and Event Management (SIEM) category. Microsoft is ranked #2 with an average rating of 8.4, while Trellix is ranked #32 with an average rating of 9.0. Microsoft holds a 10.8% mindshare in SIEM, compared to Trellix’s 0.5% mindshare. Additionally, 93% of Microsoft users are willing to recommend the solution, compared to 100% of Trellix users who would recommend it.

Microsoft Sentinel

Read 89 Microsoft Sentinel reviews

23,840 Views
13,739 Comparison Views

93% willing to recommend

Trellix Helix

Read 10 Trellix Helix reviews

1,108 Views
739 Comparison Views

100% willing to recommend

Microsoft Sentinel

Trellix Helix

Comparison Buyer's Guide

Download the report

Executive SummaryUpdated on Sep 18, 2024

Trellix Helix and Microsoft Sentinel are competing security information and event management (SIEM) products. Users are happier with the pricing and support of Trellix Helix, but Microsoft Sentinel seems to be a superior product due to its features.

Features: Trellix Helix users value its robust integration capabilities, advanced threat detection, and straightforward deployment. Microsoft Sentinel users appreciate its scalability, comprehensive analytics, and seamless integration with other Microsoft products.

Room for Improvement: Trellix Helix users suggest better documentation, more efficient query performance, and improvements in alert management. Microsoft Sentinel users mention needing a more intuitive configuration process, enhancements in alert management, and faster support response.

Ease of Deployment and Customer Service: Trellix Helix is praised for its straightforward deployment and responsive customer service. Microsoft Sentinel is noted for its seamless integration with other Microsoft products but sometimes lacks immediate customer service responses.

Pricing and ROI: Trellix Helix users feel it offers good value for the cost with favorable ROI. Microsoft Sentinel is considered more expensive but justifiable due to its extensive features and strong ROI.

To learn more, read our detailed Microsoft Sentinel vs. Trellix Helix Report (Updated: October 2024).

Buyer's Guide

Microsoft Sentinel vs. Trellix Helix

October 2024

Download the complete report

Helped 814,649 peers since 2012

Categories and Ranking

Microsoft Sentinel

Ranking in Security Information and Event Management (SIEM)

2nd

Average Rating

8.2

Reviews Sentiment

7.1

Number of Reviews

Ranking in other categories

Security Orchestration Automation and Response (SOAR) (1st), Microsoft Security Suite (5th)

Trellix Helix

Ranking in Security Information and Event Management (SIEM)

32nd

Average Rating

8.8

Number of Reviews

Ranking in other categories

Security Incident Response (7th)

Mindshare comparison

As of November 2024, in the Security Information and Event Management (SIEM) category, the mindshare of Microsoft Sentinel is 10.8%, down from 12.8% compared to the previous year. The mindshare of Trellix Helix is 0.5%, down from 0.8% compared to the previous year. It is calculated based on PeerSpot user engagement data.

Security Information and Event Management (SIEM)

Featured Reviews

Nitin Arora

Security Delivery Senior Analyst at Accenture

Nov 2, 2022

Gives us one place to investigate and respond to threats, and automation eliminates manual work

They can work on the EDR side of things. It is already really superb, because of the kinds of features we get with the EDR solution. It's not a standard EDR and they have recently enhanced things. But the problem is with onboarding devices. I have different OS flavors, including a large number of Linux, Windows, macOS, and some on-prem machines as well. Every time we need to onboard these kinds of machines into the EDR, we need to do it with the help of Intune, to sync up the devices, and do the configuration. I'm looking for something on the EDR side that will reduce this kind of work. They can eliminate having to do manual configuration for the machines, and check the different types of configurations for each OS. In some cases, it does not support some OSs. If they could reduce this type of work, that would be really amazing.

Read full review

Abanoub Alfy

Information Technology Security Analyst at EBC

May 15, 2023

Helps prevent email attacks, like phishing and email spoofing attacks

We use Trellix Helix for protection against network attacks, TLS, and SSL attacks. We also use the solution for user behaviour accesses Trellix Helix helps prevent email attacks, like phishing and email spoofing attacks. Trellix Helix's configuration and learning could be improved to identify…

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"The Identity Behavior tab furnishes us with the entire history linked to each IP or domain that has either accessed or attempted to access our system."

"The UI of Sentinel is very good and easy to use, even for beginners."

"The UI-based analytics are excellent."

"Sentinel is a SIEM and SOAR tool, so its automation is the best feature; we can reduce human interaction, freeing up our human resources."

"The initial setup is very simple and straightforward."

"The scalability is great. You can put unlimited logs in, as long as you can pay for it. There are commitment tiers, up to six terabytes per day, which is nowhere close to what any one of our customers is running."

"Native integration with Microsoft security products or other Microsoft software is also crucial. For example, we can integrate Sentinel with Office 365 with one click. Other integrations aren't as easy. Sometimes, we have to do it manually."

"The most valuable feature is the alert notifications, which are categorized by severity levels: informational, low, medium, and high."

More Microsoft Sentinel pros

"FireEye Helix's best features are its speed and use of an easy-to-understand language to send queries to the raw logs."

"The product offers very strong automation. Our cyber security analysts don't have to correlate the information to detect problems. They only need to analyze problems that have been identified by the platform."

"We have started working with various customers, one of whom is particularly concerned about adjacency. We have identified several use cases where automation is possible."

"It is kind of simple and very easily deployable. You can start working with it very fast."

"We are able to block some advanced malware and other things."

"Trellix Helix helps prevent email attacks, like phishing and email spoofing attacks."

"As far as its core functionality goes, it’s spot-on."

"I like that it's easy. It's got the protection set up, and we can see whatever is required. We write our own rules and the rules that we can input. I think it is good."

More Trellix Helix pros

Cons

"At the network level, there is a limitation in integrating some of the switches or routers with Microsoft Sentinel. Currently, SPAN traffic monitoring is not available in Microsoft Sentinel. I have heard that it is available in Defender for Identity, which is a different product. It would be good if LAN traffic monitoring or SPAN traffic monitoring is available in Microsoft Sentinel. It would add a lot of value. It is available in some of the competitor products in the market."

"The learning curve could be improved. I am still learning it. We were able to implement the basic features to get them up and running, but there are still so many things that I don't know about all its features. They have a lot of features that we have not been able to use or apply. If they could work on reducing the solution's learning curve, that would be good. While there is a training course held by Microsoft to learn more about this solution, there is a cost associated with it."

"The on-prem log sources still require a lot of development."

"They should integrate it with many other software-as-a-service providers and make connectors available so that you don't have to do any sort of log normalization."

"We do have in-built or out-of-the-box metrics that are shown on the dashboard, but it doesn't give the kind of metrics that we need from our environment whereby we need to check the meantime to detect and meantime to resolve an incident. I have to do it manually. I have to pull all the logs or all the alerts that are fed into Sentinel over a certain period. We do this on a monthly basis, so I go into Microsoft Sentinel and pull all the alerts or incidents we closed over a period of thirty days."

"Improvement-wise, I would like to see more integration with third-party solutions or old-school antivirus products that have some kind of logging capability. I wouldn't mind having that exposed within Sentinel. We do have situations where certain companies have bought licensing or have made an investment in a product, and that product will be there for the next two or three years. To be able to view information from those legacy products would be great. We can then better leverage the Sentinel solution and its capabilities."

"Sentinel could improve its ticketing and management. A few customers I have worked with liked to take the data created in Sentinel. You can make some basic efforts around that, but the customers wanted to push it to a third-party system so they could set up a proper ticketing management system, like ServiceNow, Jira, etc."

"I can't think of anything other than just getting the name out there. I think a lot of customers don't fully understand the full capabilities of Azure Sentinel yet. It is kind of like when they're first starting to use Azure, it might not be something they first think about. So, they should just kind of get to the point where it is more widely used."

More Microsoft Sentinel cons

"It should have more cloud connectors. It could also be cheaper."

"Integrations could be improved, and the dashboard could be a little better."

"FireEye Helix would be improved with the option of an on-prem version, which they don't currently offer."

"Sometimes the rules are disabled by FireEye, and we basically get it after the patch. I think there needs to be a better way of creating the application rules. I would like to see better pricing for our licensing."

"The graphical user interface could be improved. It's not easy to handle and it's not easy for a customer or end-user to learn how to manage the solution."

"We have certain challenges with integrating the SOAR platform with multiple vendors."

"Trellix Helix's configuration and learning could be improved to identify normal traffic from abnormal and to identify trusted domains."

"We often rely on Martins to create logs and provide professional threat services rather than basic support."

More Trellix Helix cons

Pricing and Cost Advice

"It is a consumption-based license model. bands at 100, 200, 400 GB per day etc. Azure Sentinel Pricing | Microsoft Azure"

"The pricing is fair... With a traditional SIEM, you pay a lump sum for licenses. But with Sentinel, it's pay-as-you-go according to the amount of data you inject."

"It is priced fairly given the value that you get from the use of the product. The biggest mistake people make with Microsoft Sentinel is not understanding the pricing model and the amount of data that they are going to be running through the tool because you are paying based on the flow. You are paying based on the amount of data that is moving through the tool. People do not plan, and therefore, they get surprised by the cost associated with using the tool. They connect everything because they want to know everything, but connecting everything is very expensive."

"Microsoft Sentinel is included in our E5 license."

"Microsoft Sentinel can be costly, particularly for data management."

"I'm not happy with the pricing on the integration with Defender for Endpoint. Defender for Endpoint is log-rich. There is a lot of information coming through, and it is needed information. The price point at which you ingest those logs has made a lot of my customers make the decision to leave that within the Defender stack."

"Microsoft Sentinel is expensive."

"The solution is expensive and there is a daily usage fee."

More Microsoft Sentinel pricing and cost advice

"It could be cheaper, but that applies to every product."

"FireEye Helix is a little expensive."

"The price could be better. But I think it's rightly placed when we buy everything in one shot, and we get some discount for that. That's how we basically plan our deployment, and it's holistic. We pay for the license yearly."

"I rate Trellix Helix a five out of ten for pricing."

See which vendors are best for you

Use our free recommendation engine to learn which Security Information and Event Management (SIEM) solutions are best for your needs.

See recommendations

814,649 professionals have used our research since 2012.

Top Industries

By visitors reading reviews

Computer Software Company

16%

Financial Services Firm

10%

Government

Manufacturing Company

Computer Software Company

16%

Comms Service Provider

13%

Manufacturing Company

11%

Financial Services Firm

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

Questions from the Community

Is there a common threat intelligence tool that aggregates multiple threat intelligence sources?

Yes, Azure Sentinel is a SIEM on the Cloud. Multiple data sources can be uploaded and analyzed with Azure Sentinel and its Threat Hunting functionality with AI available as templates or customized ...

See all answers

What is a better choice, Splunk or Azure Sentinel?

It would really depend on (1) which logs you need to ingest and (2) what are your use cases Splunk is easy for ingestion of anything, but the charge per GB/Day Indexed and it gets expensive as log ...

See all answers

Which is better - Azure Sentinel or AWS Security Hub?

We like that Azure Sentinel does not require as much maintenance as legacy SIEMs that are on-premises. Azure Sentinel is auto-scaling - you will not have to worry about performance impact, you will...

See all answers

What do you like most about FireEye Helix?

Trellix Helix helps prevent email attacks, like phishing and email spoofing attacks.

See all answers

What is your experience regarding pricing and costs for FireEye Helix?

The pricing is reasonable compared to its competitors.

See all answers

What needs improvement with FireEye Helix?

There is room for improvement in the integration capabilities of third-party tools. It has no problem connecting all solutions to Helix. Right now, we only connect one of Trellix's appliances to th...

See all answers

Comparisons

AWS Security Hub vs Microsoft Sentinel

Compared 20% of the time

IBM Security QRadar vs Microsoft Sentinel

Compared 10% of the time

Cortex XSIAM vs Microsoft Sentinel

Compared 7% of the time

Wazuh vs Microsoft Sentinel

Compared 6% of the time

Google Chronicle Suite vs Microsoft Sentinel

Compared 5% of the time

More Microsoft Sentinel Competitors

Splunk Enterprise Security vs Trellix Helix

Compared 27% of the time

Trellix ESM vs Trellix Helix

Compared 14% of the time

IBM Security QRadar vs Trellix Helix

Compared 11% of the time

LogRhythm SIEM vs Trellix Helix

Compared 9% of the time

Fortinet FortiSIEM vs Trellix Helix

Compared 9% of the time

More Trellix Helix Competitors

Product Reports

Buyer's Guide

Microsoft Sentinel

October 2024

Download Microsoft Sentinel product report

Buyer's Guide

Trellix Helix

October 2024

Download Trellix Helix product report

Also Known As

Azure Sentinel

FireEye Helix, FireEye Threat Analytics

Learn More

Microsoft

Video not available

Trellix

Overview

Microsoft Sentinel is a scalable, cloud-native, security information event management (SIEM) and security orchestration automated response (SOAR) solution that lets you see and stop threats before they cause harm. Microsoft Sentinel delivers intelligent security analytics and threat intelligence across the enterprise, providing a single solution for alert detection, threat visibility, proactive hunting, and threat response. Eliminate security infrastructure setup and maintenance, and elastically scale to meet your security needs—while reducing IT costs. With Microsoft Sentinel, you can:

- Collect data at cloud scale—across all users, devices, applications, and infrastructure, both on-premises and in multiple clouds

- Detect previously uncovered threats and minimize false positives using analytics and unparalleled threat intelligence from Microsoft

- Investigate threats with AI and hunt suspicious activities at scale, tapping into decades of cybersecurity work at Microsoft

- Respond to incidents rapidly with built-in orchestration and automation of common tasks

To learn more about our solution, ask questions, and share feedback, join our Microsoft Security, Compliance and Identity Community.

Trellix Helix is a cutting-edge product that revolutionizes the way businesses manage their data and streamline their operations. With its advanced features and user-friendly interface, Trellix Helix offers a comprehensive solution for businesses of all sizes. One of the key features of Trellix Helix is its powerful data management capabilities.

The product allows businesses to store, organize, and analyze large volumes of data in a secure and efficient manner. With its intuitive interface, users can easily navigate through the system and access the information they need, saving valuable time and effort. Trellix Helix also offers seamless integration with other business applications, making it a versatile tool for businesses. It can be easily integrated with existing systems, such as CRM and ERP software, allowing for a smooth flow of data across different platforms. This integration ensures that businesses have a holistic view of their operations and can make informed decisions based on accurate and up-to-date information.

Another standout feature of Trellix Helix is its robust reporting and analytics capabilities. It provides businesses with real-time insights and actionable intelligence, enabling them to identify trends, spot opportunities, and make data-driven decisions. The customizable dashboards and reports allow users to visualize data in a meaningful way, making it easier to understand complex information and communicate it effectively to stakeholders.

Trellix Helix offers advanced security features to protect sensitive business data. It employs industry-standard encryption protocols and access controls to ensure that data is secure and only accessible to authorized personnel. This level of security gives businesses peace of mind, knowing that their valuable information is protected from unauthorized access or breaches.

Helix is a comprehensive and user-friendly solution for businesses looking to optimize their data management and streamline their operations. With its advanced features, seamless integration, robust reporting, and analytics capabilities, as well as top-notch security, Trellix Helix empowers businesses to make informed decisions, improve efficiency, and drive growth.

Sample Customers

Microsoft Sentinel is trusted by companies of all sizes including ABM, ASOS, Uniper, First West Credit Union, Avanade, and more.

Police Bank, Verisk Analytics, Teck Resources

Buyer's Guide

Microsoft Sentinel vs. Trellix Helix

October 2024

Free Report: Microsoft Sentinel vs. Trellix Helix

Find out what your peers are saying about Microsoft Sentinel vs. Trellix Helix and other solutions. Updated: October 2024.

DOWNLOAD NOW

814,649 professionals have used our research since 2012.

See our Microsoft Sentinel vs. Trellix Helix report.

See our list of best Security Information and Event Management (SIEM) vendors.

We monitor all Security Information and Event Management (SIEM) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.