Microsoft Sentinel pros and cons

4.1 out of 5

89 reviews
93% willing to recommend

307 followers

Pros & Cons summary

Microsoft Sentinel offers powerful AI and machine learning for efficient threat detection and response. It integrates with Microsoft services, enhancing user experience and operational continuity. Kusto Query Language supports detailed data analysis. Automation through Azure Logic Apps streamlines incident response. It is cost-effective for Microsoft platform users, yet challenging documentation and integration with third-party solutions remain. An alternative to KQL is needed for users lacking query language expertise, affecting functionality.

Buyer's Guide

Get pricing advice, tips, use cases and valuable features from real users of this product.

Get the report

Prominent pros & cons

PROS

Microsoft Sentinel offers a comprehensive set of features that enhance security, such as seamless integration with other Microsoft products, advanced threat detection capabilities, and automated response playbooks.

The tool streamlines security operations by offering a unified approach to managing incidents, reducing the need for multiple platforms.

Microsoft Sentinel provides powerful analytics and machine learning capabilities, helping organizations efficiently predict and address potential security threats.

The usability and accessibility of Microsoft Sentinel are enhanced due to its cloud-based nature, facilitating easy setup and scalability without the burdens of managing physical infrastructure.

Microsoft Sentinel is highly integrative, supporting a wide range of data connectors from various vendors, which enables a more extensive monitoring and security framework.

CONS

Microsoft Sentinel could improve its integration with third-party security products and SIEM solutions, as some essential connectors and capabilities are missing.

The cost and pricing model of Microsoft Sentinel are areas that require improvement, as clients find it confusing and expensive.

Documentation for Microsoft Sentinel, especially around the Kusto Query Language, should be enhanced to assist users lacking Microsoft certification or expertise.

There is a need for more out-of-the-box connectors and analytics rules tailored to specific industries within Microsoft Sentinel.

Ingestion of logs and data from various sources in Microsoft Sentinel can be delayed and inconsistent, impacting performance and transparency.

Microsoft Sentinel Pros review quotes

Adam Gordon

EXECUTIVE CONSULTANT at Freelance

Jul 18, 2023

It is able to connect to an ever-growing number of platforms and systems within the Microsoft ecosystem, such as Azure Active Directory and Microsoft 365 or Office 365, as well as to external services and systems that can be brought in and managed. We can manage on-premises infrastructure. We can manage not just the things that are running in Azure in the public cloud, but through Azure Arc and the hybrid capabilities, we can monitor on-premises servers and endpoints. We can monitor VMware infrastructure, for instance, running as part of a hybrid environment.