IT Central Station is now PeerSpot: Here's why

Elastic Security vs Microsoft Sentinel comparison

Cancel
You must select at least 2 products to compare!
Devo Logo
Read 16 Devo reviews.
13,174 views|5,180 comparisons
Elastic Logo
32,622 views|27,785 comparisons
Microsoft Logo
17,931 views|12,368 comparisons
Featured Review
Buyer's Guide
Elastic Security vs. Microsoft Sentinel
May 2022
Find out what your peers are saying about Elastic Security vs. Microsoft Sentinel and other solutions. Updated: May 2022.
610,190 professionals have used our research since 2012.
Quotes From Members
We asked business professionals to review the solutions they use.
Here are some excerpts of what they said:
Pros
"Devo helps us to unlock the full power of our data because they have more than 450 parsers, which means that we can ingest pretty much any type of log data.""The user interface is really modern. As an end-user, there are a lot of possibilities to tailor the platform to your needs, and that can be done without needing much support from Devo. It's really flexible and modular. The UI is very clean.""The user experience [is] well thought out and the workflows are logical. The dashboards are intuitive and highly customizable.""The most valuable feature is that it has native MSSP capabilities and maintains perfect data separation. It does all of that in a very easy-to-manage cloud-based solution.""It's very, very versatile.""The thing that Devo does better than other solutions is to give me the ability to write queries that look at multiple data sources and run fast. Most SIEMs don't do that. And I can do that by creating entity-based queries. Let's say I have a table which has Okta, a table which has G Suite, a table which has endpoint telemetry, and I have a table which has DNS telemetry. I can write a query that says, 'Join all these things together on IP, and where the IP matches in all these tables, return to me that subset of data, within these time windows.' I can break it down that way.""The ability to have high performance, high-speed search capability is incredibly important for us. When it comes to doing security analysis, you don't want to be doing is sitting around waiting to get data back while an attacker is sitting on a network, actively attacking it. You need to be able to answer questions quickly. If I see an indicator of attack, I need to be able to rapidly pivot and find data, then analyze it and find more data to answer more questions. You need to be able to do that quickly. If I'm sitting around just waiting to get my first response, then it ends up moving too slow to keep up with the attacker. Devo's speed and performance allows us to query in real-time and keep up with what is actually happening on the network, then respond effectively to events.""The querying and the log-retention capabilities are pretty powerful. Those provide some of the biggest value-add for us."

More Devo Pros →

"Elastic is straightforward, easy to integrate, and highly customizable.""It is very quick to react. I can set it to check anomalies or suspicious behavior every 30 seconds. It is very fast.""I like the indexing of the logs.""Elastic has a lot of beats, such as Winlogbeat and Filebeat. Beats are the agents that have to be installed on the terminals to send the data. When we install beats or Elastic agents on every terminal, they don't overload the terminals. In other SIEM solutions such as Splunk or QRadar, when beats or agents are installed on endpoints, they are very heavy for the terminals. They consume a lot of power of the terminals, whereas Elastic agents hardly consume any power and don't overload the terminals.""The most valuable features of the solution are the prevention methods and the incident alerts.""It's not very complicated to install Elastic.""Its flexibility is most valuable. We can have a number of scenarios, and we can get logs from anything. If we know how to use Logstash, we can tweak it in many ways. This makes the logging search on Elastic very easy.""The cost is reasonable. It's not overly pricey."

More Elastic Security Pros →

"The best functionality that you can get from Azure Sentinel is the SOAR capability. So, you can estimate any type of activity, such as when an alert was triggered or an incident was found.""The pricing of the product is excellent.""Having your logs put all in one place with machine learning working on those logs is a good feature. I don't need to start thinking, "Where are my logs?" My logs are in a centralized repository, like Log Analytics, which is why you can't use Sentinel without Log Analytics. Having all those logs in one place is an advantage.""One of the most valuable features is that it creates a kind of a single pane of glass for organizations that already use Microsoft software. So, when they have things like Microsoft 365, it is very easy for them to kind of plug in or enroll those endpoints into the Azure Sentinel service.""We’ve got process improvement that's happened across multiple different fronts within the organization, within our IT organization based on this tool being in place.""The most valuable feature is the performance because unlike legacy SIEMs that were on-premises, it does not require as much maintenance.""It's pretty powerful and its performance is pretty good.""It has basic out-of-the-box integrations with multiple log sources."

More Microsoft Sentinel Pros →

Cons
"I would like to have the ability to create more complex dashboards.""Devo has a lot of cloud connectors, but they need to do a little bit of work there. They've got good integrations with the public cloud, but there are a lot of cloud SaaS systems that they still need to work with on integrations, such as Salesforce and other SaaS providers where we need to get access logs.""From our experience, the Devo agent needs some work. They built it on top of OS Query's open-source framework. It seems like it wasn't tuned properly to handle a large volume of Windows event logs. In our experience, there would definitely be some room for improvement. A lot of SIEMs on the market have their own agent infrastructure. I think Devo's working towards that, but I think that it needs some improvement as far as keeping up with high-volume environments.""We only use the core functionality and one of the reasons for this is that their security operation center needs improvement.""The overall performance of extraction could be a lot faster, but that's a common problem in this space in general. Also, the stock or default alerting and detecting options could definitely be broader and more all-encompassing. The fact that they're not is why we had to write all our own alerts.""Some basic reporting mechanisms have room for improvement. Customers can do analysis by building Activeboards, Devo’s name for interactive dashboards. This capability is quite nice, but it is not a reporting engine. Devo does provide mechanisms to allow third-party tools to query data via their API, which is great. However, a lot of folks like or want a reporting engine, per se, and Devo simply doesn't have that. This may or may not be by design.""Some third-parties don't have specific API connectors built, so we had to work with Devo to get the logs and parse the data using custom parsers, rather than an out-of-the-box solution.""Technical support could be better."

More Devo Cons →

"There isn't really a very good user experience. You need a lot of training.""This type of monitoring is not very mature just yet. We need more real-time information in a way that's easier to manage.""The process of designing dashboards is a little cumbersome in Kibana. Unless you are an expert, you will not be able to use it. The process should be pretty straightforward. The authentication feature is what we are looking for. We would love to have a central authentication system in the open-source edition without the need for a license or an enterprise license. If they can give at least a simple authentication system within a company. In a large organization, authentication is very essential for security because logs can contain a lot of confidential data. Therefore, an authentication feature for who accesses it should be there.""I would like the process of retrieving archived data and viewing it in Kibana to be simplified.""The solution does not have a UI and this is one of the reasons we are looking for another solution.""The solution needs to be more reactive to investigations. We need to be able to detect and prevent any attacks before it can damage our infrastructure. Currently, this solution doesn't offer that.""With Elastic, you have to build the use cases for the specific requirement. Other products have a simple integration and more use cases to integrate out-of-the-box solutions for SIEM.""The training that is offered for Elastic is in need of improvement because there is no depth to it."

More Elastic Security Cons →

"Multi-tenancy, in my opinion, needs to be improved. I believe it can do better as a managed service provider.""It has been a challenge with Azure Sentinel to onboard the Syslog server from FortiGate. Azure Sentinel can work better on that shift between the Syslog server and a firewall.""They could use some kind of workbook. There is some limitation doing the editing and creating the workbook.""There is a wider thing called Jupyter Notebooks, which is around the automation side of things. It would be good if there are playbooks that you can utilize without having to have the developer experience to do it in-house. Microsoft could provide more playbooks or more Jupyter Notebooks around MITRE ATT&CK Framework.""We'd like to see more connectors.""They're giving us the queries so we can plug them right into Sentinel. They need to have a streamlined process for updating them in the tool and knowing when things are updated and knowing when there are new detections available from Microsoft.""We do see continuous improvement all the time, however, I haven't got a specific feature that is lacking or not well designed.""The solution should allow for a streamlined CI/CD procedure."

More Microsoft Sentinel Cons →

Pricing and Cost Advice
  • "We have an OEM agreement with Devo. It is very similar to the standard licensing agreement because we are charged in the same way as any other customer, e.g., we use the backroom."
  • "I'm not involved in the financial aspect, but I think the licensing costs are similar to other solutions. If all the solutions have a similar cost, Devo provides more for the money."
  • "Devo is definitely cheaper than Splunk. There's no doubt about that. The value from Devo is good. It's definitely more valuable to me than QRadar or LogRhythm or any of the old, traditional SIEMs."
  • "[Devo was] in the ballpark with at least a couple of the other front-runners that we were looking at. Devo is a good value and, given the quality of the product, I would expect to pay more."
  • "Be cautious of metadata inclusion for log types in pricing, as there are some "gotchas" with that."
  • "Devo was very cost-competitive... Devo did come with that 400 days of hot data, and that was not the case with other products."
  • "Our licensing fees are billed annually and per terabyte."
  • "I like the pricing very much. They keep it simple. It is a single price based on data ingested, and they do it on an average. If you get a spike of data that flows in, they will not stick it to you or charge you for that. They are very fair about that."
  • More Devo Pricing and Cost Advice →

  • "This is an open-source product, so there are no costs."
  • "It's a monthly cost with Elastic SIEM, but I am not sure of the exact cost."
  • "It is easy to deploy, easy to use, and you get everything you need to become operational with it, and have nothing further to pay unless you want the OLED plugin."
  • "Compared to other products such as Dynatrace, this is one of the cheaper options."
  • "The solution is free."
  • "Its price is fine. Its licensing works on a yearly basis. We have to renew the license every year. I also have a good experience with Darktrace. When we buy Darktrace, we get training free of cost, which is not there in Elastic. We have to pay extra for training. There is certainly room for improvement."
  • "I find it better than Splunk in terms of cost-effectiveness. For cost-effectiveness, I would rate it a nine out of 10."
  • "Affordable but with additional costs"
  • More Elastic Security Pricing and Cost Advice →

  • "It comes with a Microsoft subscription which the customer has, so they don't have to invest somewhere else."
  • "It is a consumption-based license model. bands at 100, 200, 400 GB per day etc. Azure Sentinel Pricing | Microsoft Azure"
  • "Good monthly operational cost model for the detection and response outcomes delivered, M365 logs don't count toward the limits which is a good benefit."
  • "I have had mixed feedback. At one point, I heard a client say that it sometimes seems more expensive. Most of the clients are on Office 365 or M365, and they are forced to take Azure SIEM because of the integration."
  • "It is kind of like a sliding scale. There are different tiers of pricing that go from $100 per day up to $3,500 per day. So, it just kind of depends on how much data is being stored. There can be additional costs to the standard license other than the additional data. It just kind of depends on what other services you're spinning up in Azure, or if you're using something like Azure log analytics."
  • "I am just paying for the log space with Azure Sentinel. It costs us about $2,000 a month. Most of the logs are free. We are only paying money for Azure Firewall logs because email logs or Azure AD logs are free to use for us."
  • "Sentinel is a bit expensive. If you can figure a way of configuring it to meet your needs, then you can find a way around the cost."
  • "Azure Sentinel is very costly, or at least it appears to be very costly. The costs vary based on your ingestion and your retention charges."
  • More Microsoft Sentinel Pricing and Cost Advice →

    report
    Use our free recommendation engine to learn which Security Information and Event Management (SIEM) solutions are best for your needs.
    610,190 professionals have used our research since 2012.
    Questions from the Community
    Top Answer:The querying and the log-retention capabilities are pretty powerful. Those provide some of the biggest value-add for us.
    Top Answer:The way Devo prices things is based on the amount of data, and I wish the tiers had more granularity. Maybe at this… more »
    Top Answer:Where Devo has room for improvement is the data ingestion and parsing. We tend to have to work with the Devo support… more »
    Top Answer:With Datadog, we have near-live visibility across our entire platform. We have seen APM metrics impacted several times… more »
    Top Answer:One of the most valuable features of this solution is that it is more flexible than AlienVault.
    Top Answer:The licensing cost depends on the size of the environment it's monitoring. Everything is based on volume, as with all… more »
    Top Answer:Yes, Azure Sentinel is a SIEM on the Cloud. Multiple data sources can be uploaded and analyzed with Azure Sentinel and… more »
    Top Answer:It would really depend on (1) which logs you need to ingest and (2) what are your use cases Splunk is easy for… more »
    Top Answer:We like that Azure Sentinel does not require as much maintenance as legacy SIEMs that are on-premises. Azure Sentinel is… more »
    Comparisons
    Also Known As
    Elastic SIEM, ELK Logstash
    Azure Sentinel
    Learn More
    Overview

    Devo is the only cloud-native logging and security analytics platform that releases the full potential of all your data to empower bold, confident action when it matters most. Only the Devo platform delivers the powerful combination of real-time visibility, high-performance analytics, scalability, multitenancy, and low TCO crucial for monitoring and securing business operations as enterprises accelerate their shift to the cloud.

    Unify SIEM, endpoint security, and cloud security
    Elastic Security modernizes security operations — enabling analytics across years of data, automating key processes, and bringing native endpoint security to every host.
    Elastic Security equips teams to prevent, detect, and respond to threats at cloud speed and scale — securing business operations with a unified, open platform.

    Microsoft Sentinel is a scalable, cloud-native, security information event management (SIEM) and security orchestration automated response (SOAR) solution that lets you see and stop threats before they cause harm. Azure Sentinel delivers intelligent security analytics and threat intelligence across the enterprise, providing a single solution for alert detection, threat visibility, proactive hunting, and threat response. Eliminate security infrastructure setup and maintenance, and elastically scale to meet your security needs—while reducing IT costs. With Azure Sentinel, you can:

    - Collect data at cloud scale—across all users, devices, applications, and infrastructure, both on-premises and in multiple clouds

    - Detect previously uncovered threats and minimize false positives using analytics and unparalleled threat intelligence from Microsoft

    - Investigate threats with AI and hunt suspicious activities at scale, tapping into decades of cybersecurity work at Microsoft

    - Respond to incidents rapidly with built-in orchestration and automation of common tasks

    To learn more about our solution, ask questions, and share feedback, join our Microsoft Security, Compliance and Identity Community.

    Offer
    See Devo in Action

    See how Devo allows you to free yourself from data management, and make machine data and insights accessible.

    Learn more about Elastic Security
    Learn more about Microsoft Sentinel
    Sample Customers
    United States Air Force, Rubrik, SentinelOne, Critical Start, NHL, Panda Security, Telefonica, CaixaBank, OpenText, IGT, OneMain Financial, SurveyMonkey, FanDuel, H&R Block, Ulta Beauty, Manulife, Moneylion, Chime Bank, Magna International, American Express Global Business Travel
    Texas A&M, U.S. Air Force, NuScale Power, Martin's Point Health Care
    Microsoft Sentinel is trusted by companies of all sizes including ABM, ASOS, Uniper, First West Credit Union, Avanade, and more.
    Top Industries
    REVIEWERS
    Computer Software Company63%
    Retailer13%
    Insurance Company13%
    Comms Service Provider13%
    VISITORS READING REVIEWS
    Computer Software Company27%
    Comms Service Provider17%
    Government8%
    Financial Services Firm7%
    REVIEWERS
    Financial Services Firm38%
    Computer Software Company23%
    Comms Service Provider15%
    Healthcare Company8%
    VISITORS READING REVIEWS
    Comms Service Provider22%
    Computer Software Company22%
    Government9%
    Financial Services Firm7%
    REVIEWERS
    Financial Services Firm20%
    Computer Software Company13%
    Government7%
    Outsourcing Company7%
    VISITORS READING REVIEWS
    Computer Software Company25%
    Comms Service Provider18%
    Government8%
    Financial Services Firm6%
    Company Size
    REVIEWERS
    Small Business24%
    Midsize Enterprise18%
    Large Enterprise59%
    VISITORS READING REVIEWS
    Small Business21%
    Midsize Enterprise17%
    Large Enterprise62%
    REVIEWERS
    Small Business50%
    Midsize Enterprise19%
    Large Enterprise31%
    VISITORS READING REVIEWS
    Small Business20%
    Midsize Enterprise19%
    Large Enterprise61%
    REVIEWERS
    Small Business33%
    Midsize Enterprise19%
    Large Enterprise48%
    VISITORS READING REVIEWS
    Small Business20%
    Midsize Enterprise17%
    Large Enterprise63%
    Buyer's Guide
    Elastic Security vs. Microsoft Sentinel
    May 2022
    Find out what your peers are saying about Elastic Security vs. Microsoft Sentinel and other solutions. Updated: May 2022.
    610,190 professionals have used our research since 2012.

    Elastic Security is ranked 5th in Security Information and Event Management (SIEM) with 20 reviews while Microsoft Sentinel is ranked 3rd in Security Information and Event Management (SIEM) with 26 reviews. Elastic Security is rated 7.6, while Microsoft Sentinel is rated 8.0. The top reviewer of Elastic Security writes "It is quite comprehensive and you're able to do a lot of tasks". On the other hand, the top reviewer of Microsoft Sentinel writes "Easy to manage with good automation and machine learning capabilities ". Elastic Security is most compared with Splunk, Wazuh, Graylog, Datadog and syslog-ng, whereas Microsoft Sentinel is most compared with AWS Security Hub, Splunk, IBM QRadar, Rapid7 InsightIDR and AlienVault OSSIM. See our Elastic Security vs. Microsoft Sentinel report.

    See our list of best Security Information and Event Management (SIEM) vendors.

    We monitor all Security Information and Event Management (SIEM) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.