Microsoft Sentinel
By Microsoft
Microsoft's cloud SIEM with automation playbooks and consumption-based data ingestion. Many Microsoft 365 log sources ingest without charge. New customers have been directed to the Microsoft Defender portal since July 2025, and support for the Azure portal experience ends March 31, 2027.
- Product type
- Software
- Deployment
- SaaS
- Organization size
- SMBMid-marketEnterprise
- Pricing tier
- $$
Capability checklist
SIEMHow Microsoft Sentinel measures up against the full Security Information & Event Management taxonomy.
- Broad log ingestion — supported
- Collects and normalizes logs from network, endpoint, cloud, and SaaS sources.
- Correlation & detection rules — supported
- Turns raw events into alerts via built-in and custom detection logic.
- Fast historical search — supported
- Query months of data quickly during investigations.
- Behavior analytics (UEBA) — supported
- Baselines user and entity behavior to flag anomalies.
- Dashboards & reporting — supported
- Compliance and operational reporting out of the box.
- Detection-as-code — not supported
- Manage detection rules in version control with CI.
Alternatives
Other Security Information & Event Management tools with overlapping capabilities, sized for similar teams.
Appears in stacks
Real-world stacks that include Microsoft Sentinel.