Siemplify vs Trellix Helix comparison

Security Orchestration Automation and Response (SOAR)

Download the complete report

Helped 787,817 peers since 2012

Categories and Ranking

Microsoft Sentinel

Mindshare comparison

As of June 2024, in the Security Orchestration Automation and Response (SOAR) category, the mindshare of Microsoft Sentinel is 20.2%, up from 17.6% compared to the previous year. The mindshare of Siemplify is 1.6%, down from 2.5% compared to the previous year. The mindshare of Trellix Helix is 0.4%, down from 0.7% compared to the previous year. It is calculated based on PeerSpot user engagement data.

Security Orchestration Automation and Response (SOAR)

Unique Categories:

Security Information and Event Management (SIEM)

13.7%

Microsoft Security Suite

5.3%

No other categories found

Security Incident Response

5.0%

Featured Reviews

Sachin Paul

Product Manager, Cyber Security at Mactel

Dec 11, 2023

Makes data integration very easy for our SOC

It enables data integration within our hybrid, multi-cloud environment, and it makes this data integration very easy for our security operations center. Sentinel has helped improve our visibility into user and network behavior. It helps in identifying risky users, creating a watch list for specific users and their activities, which is very important. It has also been saving us time. It's a complete cloud-based solution, so there is no time wasted on setting up servers, infrastructure, et cetera. It also reduces the work involved in event investigation because it puts together detection logic through detection rules. That helps in automating incident identification.

Read full review

Cyrus Robinson, CISSP, CEH, CHFI, MCSE, MCITP, MCSA

SOC Director at Ingalls Information Security

Apr 26, 2023

Great for reporting and ticketing for SOC MxDR client environments and has a great, supportive community

There are so many incredible features in the Chronicle SOAR platform that it's difficult to narrow down the list, however, if I had to choose, I would say that the most valuable features are the playbook builder and the integrations. The playbook builder allows us to establish workflows for the various case types that our analysts encounter within the SOC. These can be as granular or as high level as they need to be depending upon our business objectives and alert priorities. In turn, the tremendous number of integrations in the marketplace and the IDE (to custom-develop new integrations) are what make the playbooks as powerful as they are. Together, the integrations and playbooks make it simple to integrate powerful new capabilities and workflows.

Read full review

Abanoub Alfy

Information Technology Security Analyst at EBC

May 15, 2023

Helps prevent email attacks, like phishing and email spoofing attacks

We use Trellix Helix for protection against network attacks, TLS, and SSL attacks. We also use the solution for user behaviour accesses Trellix Helix helps prevent email attacks, like phishing and email spoofing attacks. Trellix Helix's configuration and learning could be improved to identify…

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"Log aggregation and data connectors are the most valuable features."

"The scalability is great. You can put unlimited logs in, as long as you can pay for it. There are commitment tiers, up to six terabytes per day, which is nowhere close to what any one of our customers is running."

"In Azure Sentinel, we have found, they do have a store in their capability. AI and intelligence features. We found that to be very helpful for us because some other things we do need to integrate again or find another vendor for the store"

"The best functionality that you can get from Azure Sentinel is the SOAR capability. So, you can estimate any type of activity, such as when an alert was triggered or an incident was found."

"What is most useful, is that it has a good connection to the Microsoft ecosystem, and I think that's the key part."

"The solution has features that helped improve the security posture of our clients. It provides the ability to correlate a large variety of log sources very cost-effectively, especially for Microsoft sources."

"Previously, it was a little bit difficult to find where an incident came from, including which IP address and which country. So in Sentinel, it's very easy to find where the incident came from since we can easily get the information from the dashboard, after which we take action quickly."

"Sentinel's most important feature is the ability to centralize all the logs in one place. There's no need to search multiple systems for information."

More Microsoft Sentinel pros

"The most valuable feature of Siemplify is the playbooks that can be created."

"Without hyperbole, I have never, in my entire career, encountered a vendor or a vendor community as awesome as Siemplify. Siemplify and the Siemplify Community quite literally made it possible for our SOC to increase almost five-fold in our number of clients and number of analysts and to go from a Monday to Friday 9-5 shop to a 24/7 shop all in the span of under a year and a half and all while continually adding capabilities and improving the services we offer to our clients."

"The playbooks feature in Siemplify is crucial for automation. We've utilized both standard and custom integrations with other security operation solutions, enhancing our flexibility. The user interface is generally straightforward, although recent changes may require some adjustment and Siemplify's integrations and capabilities offer potential support for various compliance requirements."

"It is kind of simple and very easily deployable. You can start working with it very fast."

"The most valuable features include predefined use cases and threatening states."

"I like that it's easy. It's got the protection set up, and we can see whatever is required. We write our own rules and the rules that we can input. I think it is good."

"FireEye Helix's best features are its speed and use of an easy-to-understand language to send queries to the raw logs."

"Trellix Helix helps prevent email attacks, like phishing and email spoofing attacks."

"The product offers very strong automation. Our cyber security analysts don't have to correlate the information to detect problems. They only need to analyze problems that have been identified by the platform."

"The integration is very useful and very easy. You can have an API connection with any cloud and I'll be able to do both ways of communication with the help of APA."

Cons

"The built-in SOAR is not really good out-of-the-box. The SOAR relies on logic apps and you almost need to have some kind of developer background to be able to make these logic apps. Most security people cannot develop anything..."

"There is some relatively advanced knowledge that you have to have to properly leverage Sentinel's full capabilities. I'm thinking about things like the creation of workbooks, how you do threat-hunting, and the kinds of notifications you're getting... It takes time for people to ramp up on that and develop a familiarity or expertise with it."

"Documentation is the main thing that could be improved. In terms of product usage, the documentation is pretty good, but I'd like a lot more documentation on Kusto Query Language."

"Everyone has their favorites. There is always room for improvement, and everybody will say, "I wish you could do this for me or that for me." It is a personal thing based on how you use the tool. I do not necessarily have those thoughts, and they are probably not really valuable because they are unique to the context of the user, but broadly, where it can continue to improve is by adding more connectors to more systems."

"Microsoft should improve Sentinel, considering that from the legacy systems, it cannot collect logs."

"If you're looking to use canned queries, the interface could be a little more straightforward. It's not immediately intuitive regarding how you use it. You have to take a canned query and paste it into an operational box and then you hit a button... They could improve the ease of deploying these queries."

"Sentinel should be improved with more connectors. At the moment, it only covers a few vendors. If I remember correctly, only 100 products are supported natively in Sentinel, although you can connect them with syslog. But Microsoft should increase the number of native connectors to get logs into Sentinel."

"The data connectors for third-party tools could be improved, as some aren't available in Sentinel. They need to be available in the data connector panel."

More Microsoft Sentinel cons

"Building the playbooks could be easier and the integration could improve. It is a difficult process, such as what API connections need to be made."

"We often encounter minor issues that could be improved, but we maintain communication with the developers and submit feature requests. Recently, I requested enhancements such as improved search functionality within playbooks and expanded options for exporting case data."

"I'm inclined to say that I'd love to see some Machine Learning capabilities integrated into the platform, however, I just attended a demo this morning where Siemplify gave a sneak peek into some Machine Learning capabilities that they are currently developing and have roadmapped for release soon."

"Integrations could be improved, and the dashboard could be a little better."

"The graphical user interface could be improved. It's not easy to handle and it's not easy for a customer or end-user to learn how to manage the solution."

"FireEye Helix would be improved with the option of an on-prem version, which they don't currently offer."

"Trellix Helix's configuration and learning could be improved to identify normal traffic from abnormal and to identify trusted domains."

"We have certain challenges with integrating the SOAR platform with multiple vendors."

"Sometimes the rules are disabled by FireEye, and we basically get it after the patch. I think there needs to be a better way of creating the application rules. I would like to see better pricing for our licensing."

"It should have more cloud connectors. It could also be cheaper."

Pricing and Cost Advice

"Sentinel is costly."

"Microsoft Sentinel is included in our E5 license."

"I am not involved on the financial side, but from an enterprise-wide use perspective, I think the price is good enough."

"Microsoft Sentinel requires an E5 license."

"It is priced fairly given the value that you get from the use of the product. The biggest mistake people make with Microsoft Sentinel is not understanding the pricing model and the amount of data that they are going to be running through the tool because you are paying based on the flow. You are paying based on the amount of data that is moving through the tool. People do not plan, and therefore, they get surprised by the cost associated with using the tool. They connect everything because they want to know everything, but connecting everything is very expensive."

"It's costly to maintain and renew."

"The are two native advantages for customers that use M365 Security and Sentinel. The first advantage is that the log or security-event ingestion into Sentinel is free. Cost-wise, they're saving a lot and that is a major advantage."

"From a cost perspective, there are some additional charges in addition to the licensing."

More Microsoft Sentinel pricing and cost advice

Information not available

"It could be cheaper, but that applies to every product."

"The price could be better. But I think it's rightly placed when we buy everything in one shot, and we get some discount for that. That's how we basically plan our deployment, and it's holistic. We pay for the license yearly."

"I rate Trellix Helix a five out of ten for pricing."

"FireEye Helix is a little expensive."

See which vendors are best for you

Use our free recommendation engine to learn which Security Orchestration Automation and Response (SOAR) solutions are best for your needs.

See recommendations

787,817 professionals have used our research since 2012.

Top Industries

By visitors reading reviews

Computer Software Company

16%

Financial Services Firm

10%

Government

Manufacturing Company

Computer Software Company

14%

Financial Services Firm

11%

Comms Service Provider

Energy/Utilities Company

Computer Software Company

16%

Manufacturing Company

11%

Financial Services Firm

Government

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

No data available

Questions from the Community

Is there a common threat intelligence tool that aggregates multiple threat intelligence sources?

Yes, Azure Sentinel is a SIEM on the Cloud. Multiple data sources can be uploaded and analyzed with Azure Sentinel an...

What is a better choice, Splunk or Azure Sentinel?

It would really depend on (1) which logs you need to ingest and (2) what are your use cases Splunk is easy for ingest...

Which is better - Azure Sentinel or AWS Security Hub?

We like that Azure Sentinel does not require as much maintenance as legacy SIEMs that are on-premises. Azure Sentinel...

What do you like most about Siemplify?

The playbooks feature in Siemplify is crucial for automation. We've utilized both standard and custom integrations wi...

What needs improvement with Siemplify?

We often encounter minor issues that could be improved, but we maintain communication with the developers and submit ...

What is your primary use case for Siemplify?

Siemplify has streamlined various tasks such as configuring playbooks, integrations, and running reports. It helps au...

What do you like most about FireEye Helix?

Trellix Helix helps prevent email attacks, like phishing and email spoofing attacks.

What is your experience regarding pricing and costs for FireEye Helix?

I rate Trellix Helix a five out of ten for pricing.

What needs improvement with FireEye Helix?

Trellix Helix's configuration and learning could be improved to identify normal traffic from abnormal and to identify...

AWS Security Hub vs Microsoft Sentinel

Comparisons

Compared 17% of the time

IBM Security QRadar vs Microsoft Sentinel

Compared 12% of the time

Wazuh vs Microsoft Sentinel

Compared 6% of the time

Splunk Enterprise Security vs Microsoft Sentinel

Compared 5% of the time

Elastic Security vs Microsoft Sentinel

Compared 5% of the time

More Microsoft Sentinel Competitors

Splunk SOAR vs Siemplify

Compared 39% of the time

Palo Alto Networks Cortex XSOAR vs Siemplify

Compared 28% of the time

ServiceNow Security Operations vs Siemplify

Compared 16% of the time

Fortinet FortiSOAR vs Siemplify

Compared 9% of the time

Swimlane vs Siemplify

Compared 8% of the time

More Siemplify Competitors

Splunk Enterprise Security vs Trellix Helix

Compared 16% of the time

LogRhythm SIEM vs Trellix Helix

Compared 15% of the time

Trellix ESM vs Trellix Helix

Compared 12% of the time

IBM Security QRadar vs Trellix Helix

Compared 9% of the time

USM Anywhere vs Trellix Helix

Compared 9% of the time

More Trellix Helix Competitors

Product Reports

Microsoft Sentinel

Download Microsoft Sentinel product report

Security Orchestration Automation and Response (SOAR)

Download Siemplify product report

Security Information and Event Management (SIEM)

Download Trellix Helix product report

Also Known As

Azure Sentinel

Siemplify ThreatNexus

FireEye Helix, FireEye Threat Analytics

Learn More

Microsoft

Siemplify

Video not available

Trellix

Overview

Microsoft Sentinel is a scalable, cloud-native, security information event management (SIEM) and security orchestration automated response (SOAR) solution that lets you see and stop threats before they cause harm. Microsoft Sentinel delivers intelligent security analytics and threat intelligence across the enterprise, providing a single solution for alert detection, threat visibility, proactive hunting, and threat response. Eliminate security infrastructure setup and maintenance, and elastically scale to meet your security needs—while reducing IT costs. With Microsoft Sentinel, you can:

- Collect data at cloud scale—across all users, devices, applications, and infrastructure, both on-premises and in multiple clouds

- Detect previously uncovered threats and minimize false positives using analytics and unparalleled threat intelligence from Microsoft

- Investigate threats with AI and hunt suspicious activities at scale, tapping into decades of cybersecurity work at Microsoft

- Respond to incidents rapidly with built-in orchestration and automation of common tasks

To learn more about our solution, ask questions, and share feedback, join our Microsoft Security, Compliance and Identity Community.

Siemplify offers the ability to: Manage security operations from a single platform, build repeatable, automated security processes, and track, measure and improve SOC performance.

Manage Security Operations from a Single Platform

From case creation, through investigation to remediation – Siemplify provides the intuitive, cloud-native workbench security operations teams have been craving to effectively respond at scale.

Build Repeatable, Automated Security Processes

Playbooks orchestrate over 200 of the tools that you rely on with a simple drag and drop interface. Automate repetitive tasks to free up your time for higher-value work and slash response times.

Track, Measure and Improve SOC Performance

Rise above the daily firefighting to make data-informed decisions that drive continuous improvement with machine-learning-based recommendations and advanced analytics for complete visibility of SOC activity.

- Largest independent SOAR vendor

- Purpose-built for enterprise and the leading SOAR for MSSP

- The first Cloud-native SOAR solution

Trellix Helix is a cutting-edge product that revolutionizes the way businesses manage their data and streamline their operations. With its advanced features and user-friendly interface, Trellix Helix offers a comprehensive solution for businesses of all sizes. One of the key features of Trellix Helix is its powerful data management capabilities.

The product allows businesses to store, organize, and analyze large volumes of data in a secure and efficient manner. With its intuitive interface, users can easily navigate through the system and access the information they need, saving valuable time and effort. Trellix Helix also offers seamless integration with other business applications, making it a versatile tool for businesses. It can be easily integrated with existing systems, such as CRM and ERP software, allowing for a smooth flow of data across different platforms. This integration ensures that businesses have a holistic view of their operations and can make informed decisions based on accurate and up-to-date information.

Another standout feature of Trellix Helix is its robust reporting and analytics capabilities. It provides businesses with real-time insights and actionable intelligence, enabling them to identify trends, spot opportunities, and make data-driven decisions. The customizable dashboards and reports allow users to visualize data in a meaningful way, making it easier to understand complex information and communicate it effectively to stakeholders.

Trellix Helix offers advanced security features to protect sensitive business data. It employs industry-standard encryption protocols and access controls to ensure that data is secure and only accessible to authorized personnel. This level of security gives businesses peace of mind, knowing that their valuable information is protected from unauthorized access or breaches.

Helix is a comprehensive and user-friendly solution for businesses looking to optimize their data management and streamline their operations. With its advanced features, seamless integration, robust reporting, and analytics capabilities, as well as top-notch security, Trellix Helix empowers businesses to make informed decisions, improve efficiency, and drive growth.

Sample Customers

Microsoft Sentinel is trusted by companies of all sizes including ABM, ASOS, Uniper, First West Credit Union, Avanade, and more.

FedEx Mondelez Intenrational Check Point Trustwave Atos Cyberint Bae Systems Crowe Longwall Security Telefonica Nordea HCL

Police Bank, Verisk Analytics, Teck Resources

Security Orchestration Automation and Response (SOAR)