Anomali vs Sentinel comparison

Anomali and OpenText are both solutions in the Security Information and Event Management (SIEM) category. Anomali is ranked #32 with an average rating of 8.5, while OpenText is ranked #17 with an average rating of 7.5. Anomali holds a 1.3% mindshare in SIEM, compared to OpenText’s 2.7% mindshare. Additionally, 80% of Anomali users are willing to recommend the solution, compared to 82% of OpenText users who would recommend it.

Anomali

Read 4 Anomali reviews

6,575 Views
1,907 Comparison Views

80% willing to recommend

Sentinel

Read 17 Sentinel reviews

6,198 Views
6,074 Comparison Views

82% willing to recommend

Anomali

Sentinel

Comparison Buyer's Guide

Download the report

Executive SummaryUpdated on Jan 18, 2026

Sentinel and Anomali are two key players in the cybersecurity platform arena, each offering unique strengths in threat intelligence and protection. Sentinel appears to have the upper hand in integration and automation capabilities, while Anomali leads with customizable analytics.

Features: Sentinel's valuable features include intuitive threat detection, automated incident responses, and advanced threat intelligence capabilities enhancing its integration with various systems. Anomali shines with robust threat modeling, an adaptable API for automated processes, and extensive data correlation capabilities for deep insights.

Room for Improvement: Sentinel could improve by enhancing its detailed analytics capabilities and customization options to better match specific user needs. Anomali may benefit from streamlining its deployment process to make it more user-friendly and reducing support response times for more immediate assistance. Additionally, offering more integration options out-of-the-box would strengthen its appeal.

Ease of Deployment and Customer Service: Sentinel's deployment process is straightforward, supported by responsive customer service that facilitates easy setup. In contrast, Anomali offers a more complex deployment but provides detailed customization options. Its customer service can be slower, but the detailed support can be beneficial for tailored solutions.

Pricing and ROI: Sentinel offers a competitive pricing structure, appealing to budget-conscious users due to its efficient resource utilization and the reduction in mitigation costs. Anomali's higher initial costs are offset by its ability to significantly enhance threat visibility and security posture, providing a compelling long-term ROI.

To learn more, read our detailed Anomali vs. Sentinel Report (Updated: April 2026).

Buyer's Guide

Anomali vs. Sentinel

April 2026

Download the complete report

Helped 894,738 peers since 2012

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Categories and Ranking

Anomali

Ranking in Security Information and Event Management (SIEM)

32nd

Average Rating

7.8

Reviews Sentiment

7.2

Number of Reviews

Ranking in other categories

User Entity Behavior Analytics (UEBA) (12th), Advanced Threat Protection (ATP) (21st), Threat Intelligence Platforms (TIP) (8th), Extended Detection and Response (XDR) (22nd)

Sentinel

Ranking in Security Information and Event Management (SIEM)

17th

Average Rating

7.6

Reviews Sentiment

6.7

Number of Reviews

Ranking in other categories

No ranking in other categories

Mindshare comparison

As of May 2026, in the Security Information and Event Management (SIEM) category, the mindshare of Anomali is 1.3%, up from 0.2% compared to the previous year. The mindshare of Sentinel is 2.7%, down from 3.4% compared to the previous year. It is calculated based on PeerSpot user engagement data.

Security Information and Event Management (SIEM) Mindshare Distribution
Product	Mindshare (%)
Sentinel	2.7%
Anomali	1.3%
Other	96.0%

Security Information and Event Management (SIEM)

Featured Reviews

ChrisCollins

Enterprise Security Architect V at FirstEnergy

Enables automated threat intelligence sorting and enhances proactive threat hunting capabilities

You have to have at least a threat intelligence background or a SOC analyst background to use it, as that's the information you'll dig around with in there. If you don't have that kind of knowledge, it probably can be a little hard to use, but they do provide training. They offer training not only for how to use the platform but also some basic threat intelligence training to explain what these things are and what these terms mean. My company is a customer of Anomali. I would recommend it to other people. I would advise making sure you don't pick it without testing other products and have your use cases well thought out and documented before testing, so you know it will solve the problems you're trying to address. Keep an open mind with it and realize that whatever you can dream of, you can probably do with the platform. Overall, I would rate Anomali an eight out of ten.

Read full review

Simon Johnston

Manager, Customer Success at Coltek Business Soltuions

Simple antivirus solution integrates well but could improve pricing and currency options

I don't really have experience working with these solutions. I promote them for our clients, but I don't work with them. I can't share my experience with these tools as I make assumptions about that. For both Adlumin and CrowdStrike, both confirm that they're scalable and enterprise-ready and all those kinds of things. We haven't had any specific problem with either of those. We just have a preference for which one we would prefer. If somebody says they want to use a different one from the one that we prefer, then we have to find reasons why they aren't. But scalability is not one of the reasons that one is better over the other. I don't really have advice for people that are looking into using Sentinel; just do your research across what is available. On a scale of one to ten, I rate Sentinel a seven.

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"The most valuable aspect of Anomali is the threat modeling capability."

"I have found Cyber threat intelligence (CTI) very useful and concise. The solution is easy to use."

"The feature I have found most valuable is credential monitoring. This feature is easy and quick."

"We now have a very robust collection of threat intelligence based on the capabilities that Anomali provides."

"The solution's Kusto Query Language (KQL) execution time is pretty good."

"The native integration with out-of-the box format is hassle free and allows data to be used advantageously."

"The most valuable feature of this solution is that it provides a central locking system for many event sources."

"The most valuable feature is the flexible log for identifying security threats inside an application. Sentinel is very good at this."

"It makes everything easier by automating some tasks and growing with our needs."

"The stability is phenomenal and we never had any issues with downtime or even had to restart."

"Transactional user information improves security, prevents fraud, and promotes best practices."

"Sentinel is a tool that, if it's well configured, removes from view all unnecessary information and shows you only needful entries, so you can do your job faster, more conveniently, and with high performance."

More Sentinel pros

Cons

"Less code in integration would be nice when building blocks."

"Support in the past has been top-notch, but recent trends indicate that it has taken a back seat, as we often don't get answers for days."

"An area for improvement is the intelligence sharing within the Anomali community. The tagging system can be inconsistent, as any company can use any tags for their reporting."

"A lot of tools can give you many features, such as CTI intelligence and a tax service reduction. However, many people are combining different tools together to have more capabilities. It is up to the consumer whether they want to have multiple tools or have one tool that serves the purpose. Anomali Enterprise could improve by combining all the other tools' features into one solution."

"Anomali Enterprise could improve by combining all the other tools' features into one solution."

"Creating a drag-and-drop dashboard or workbook in Sentinel is a little more complex compared to other tools like LogRhythm and IBM QRadar."

"The web interface needs to be improved, as it has a java-based way to call its controls."

"It is an ancient product."

"There is a need for more flexibility in customization, especially when working with different vendors and platforms."

"This product's connection to certain types of cloud systems could be improved. We can do Microsoft, Google, and Amazon, but there are a lot of other things happening in the cloud that we do not connect well enough to. This product could be improved with better connection to cloud-based solutions."

"On version 5, builder was somewhat unstable during deployment -> workaround strong procedure with too many middle steps of saves."

"The solution does not allow outsourced authorizations."

"It's probably not a product that I would recommend to anyone."

More Sentinel cons

Pricing and Cost Advice

"When comparing the price of Anomali Enterprise to other solutions it is in the medium to high range. However, I am satisfied with the price."

"The solution’s pricing is aligned with its competitors."

"Sentinel's slightly on the expensive side."

"We receive a pricing discount because of our ongoing partnership with Micro Focus."

"Sentinel is moderately priced."

"We inquired about getting support from the vendor, Micro Focus, but the cost was very high."

"Sentinel is a subscription-based solution."

See which vendors are best for you

Use our free recommendation engine to learn which Security Information and Event Management (SIEM) solutions are best for your needs.

See recommendations

894,738 professionals have used our research since 2012.

Top Industries

By visitors reading reviews

Financial Services Firm

14%

Manufacturing Company

Computer Software Company

Construction Company

Financial Services Firm

10%

Computer Software Company

Manufacturing Company

Comms Service Provider

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

By reviewers
Company Size	Count
Small Business	2
Midsize Enterprise	1
Large Enterprise	5

By reviewers
Company Size	Count
Small Business	9
Midsize Enterprise	3
Large Enterprise	7

Questions from the Community

What needs improvement with Anomali ThreatStream?

An area for improvement is the intelligence sharing within the Anomali community. The tagging system can be inconsistent, as any company can use any tags for their reporting. Combining all aliases ...

See all answers

What is your primary use case for Anomali ThreatStream?

I use Anomali ( /products/anomali-reviews ) for threat hunting, threat collection, operationalization of intelligence, such as indicators of compromise (IOCs), and dissemination of reports for repo...

See all answers

What advice do you have for others considering Anomali ThreatStream?

For new users, I recommend taking the training provided by Anomali as it is very well articulated. I advise reading the user manual and taking the instructor-led training sessions from the customer...

See all answers

What is your experience regarding pricing and costs for NetIQ Sentinel?

I don't have too many comments overall about pricing as we're in South Africa, so it makes more sense if it's billed in rand. They nearly always bill it in dollars, so if it can be billed in our cu...

See all answers

What needs improvement with NetIQ Sentinel?

I'm not sure what the room for improvement is for Sentinel. It needs to stay current, and it does, so I suppose that's fine. I don't have a high demand for what it should do. Price is always a cons...

See all answers

What is your primary use case for NetIQ Sentinel?

It's our go-to choice for antivirus. I use Sentinel a lot.

See all answers

Comparisons

ThreatConnect Threat Intelligence Platform (TIP) vs Anomali

Compared 5% of the time

Recorded Future vs Anomali

Compared 5% of the time

Splunk Enterprise Security vs Anomali

Compared 3% of the time

Hunters vs Anomali

Compared 3% of the time

IBM Security QRadar vs Anomali

Compared 3% of the time

More Anomali Competitors

Splunk Enterprise Security vs Sentinel

Compared 20% of the time

IBM Security QRadar vs Sentinel

Compared 10% of the time

Wazuh vs Sentinel

Compared 6% of the time

Cortex XSIAM vs Sentinel

Compared 4% of the time

CrowdStrike Falcon vs Sentinel

Compared 4% of the time

More Sentinel Competitors

Product Reports

Buyer's Guide

Threat Intelligence Platforms (TIP)

April 2026

Download Anomali product report

Buyer's Guide

Sentinel

April 2026

Download Sentinel product report

Also Known As

Match, Lens, ThreatStream, STAXX, Anomali Security Analytics

NetIQ Sentinel, Novell SIEM

Overview

Anomali delivers user-friendly cyber threat intelligence, offering concise insights with robust capabilities for evolving scenarios.

Anomali offers a powerful platform for cyber threat intelligence, allowing organizations to efficiently stream and analyze threat feeds. It excels in threat modeling, prioritizing intelligence, and supporting large-scale automation through its API, fostering a proactive security approach.

What are Anomali's Key Features?

Threat Intelligence: Provides concise and user-friendly intelligence.
Threat Modeling: Enables prioritization and efficient organization of intelligence.
Credential Monitoring: Performs quickly with efficient dataset handling.
API Automation: Supports large-scale automation for robust intelligence management.
Adaptability: Offers capabilities to grow beyond initial use cases.

Which Benefits or ROI Should Users Consider?

Efficient Intelligence Collection: Quickly gathers and organizes data for use.
Enhanced Threat Analysis: Correlates data effectively for proactive security.
Automation Support: Saves time with extensive API capabilities.
Scalability: Adapts and scales with emerging security needs.

Anomali serves as a crucial tool for threat intelligence in industries ranging from finance to healthcare. Organizations stream threat feeds into Anomali to correlate and aggregate data, enhancing security measures and facilitating thorough threat investigations. Its adaptability makes it suitable across different sectors.

Anomali

Sentinel is a robust platform offering seamless native integration, enhanced security through transactional data, and a user-friendly interface reminiscent of Microsoft Windows. Its capabilities in threat detection, monitoring, and business intelligence integration make it an attractive choice for organizations.

Sentinel simplifies security management with its advanced features, including the Kusto Query Language and automation abilities that reduce the complexity of coding tasks. The platform's correlation engine allows for efficient rule generation, while its threat visibility and intelligence features offer preparation against risks. Advanced hunting queries, anomaly dashboards, and scalability options enhance its utility. Users appreciate its seamless connections with Microsoft tools and ability to improve threat detection through cloud and business intelligence integration. However, enhancements could improve documentation on security aspects, simplify dashboards, and optimize drag-and-drop features. There are suggestions for better device integration, a shift to web interfaces, and improved customization options, although some users face challenges with Unix scripting.

What are the most important features of Sentinel?

Native Integration: Offers seamless connections with Microsoft tools.
Enhanced Security: Utilizes transactional data for better protection.
User-Friendly Interface: Features a GUI similar to Microsoft Windows.
Automation Capabilities: Simplifies coding tasks with Kusto Query Language.
Advanced Threat Visibility: Strengthens risk preparation with intelligence features.

What benefits or ROI should users consider in reviews?

Improved Security Monitoring: Provides proactive threat detection.
Increased Efficiency: Offers automation, reducing manual efforts.
Scalability: Supports growth with adaptable features.
Integration Benefits: Ensures seamless connection with existing systems.

Sentinel finds application across sectors for logging, security event monitoring, and integration with tools like Microsoft Defender for Endpoint. Users from industries such as government and academic institutions leverage its advanced SQL query support for customized responses, enhancing security measures with AI capabilities in diverse environments.

OpenText

Sample Customers

Bank of England, First Energy, UBISOFT, Bank of Hope, Blackhawk Network

Faysal Bank, GaVI, Handelsbanken, ISC Mªnster, Lambeth Council, Swisscard, The Municipality of Siena, Tukes, University of Dayton, University of the Sunshine Coast

Buyer's Guide

Anomali vs. Sentinel

April 2026

Free Report: Anomali vs. Sentinel

Find out what your peers are saying about Anomali vs. Sentinel and other solutions. Updated: April 2026.

DOWNLOAD NOW

894,738 professionals have used our research since 2012.

See our Anomali vs. Sentinel report.

See our list of best Security Information and Event Management (SIEM) vendors.

We monitor all Security Information and Event Management (SIEM) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.