LogRhythm SIEM vs Microsoft Sentinel comparison

Cancel
You must select at least 2 products to compare!
Sumo Logic Logo
4,518 views|3,195 comparisons
LogRhythm Logo
18,149 views|10,740 comparisons
Microsoft Logo
36,965 views|21,819 comparisons
Comparison Buyer's Guide
Executive Summary

We performed a comparison between LogRhythm SIEM and Microsoft Sentinel based on real PeerSpot user reviews.

Find out in this report how the two Security Information and Event Management (SIEM) solutions compare in terms of features, pricing, service and support, easy of deployment, and ROI.
To learn more, read our detailed LogRhythm SIEM vs. Microsoft Sentinel Report (Updated: May 2023).
708,544 professionals have used our research since 2012.
Featured Review
Quotes From Members
We asked business professionals to review the solutions they use.
Here are some excerpts of what they said:
Pros
"Technical support is always great.""The most valuable features of Sumo Logic Security are the rules, use cases, and ease of use. Additionally, the integration is straightforward and good GUI.""The tool has key features like operability. It will alert the admins whenever a device is onboarded.""The features I found valuable with the Sumo Logic Security solution are the search option and the ability to customize the search for the information in the logs."

More Sumo Logic Security Pros →

"One of the main features that I like about LogRhythm NextGen SIEM is that there are a lot of pre-built pieces. Like with our AV, we didn't have to tell it how to read the logs; they already had it pre-made. So, we essentially just had to follow their guide to get the logs imported in and set up some rules for it. We've only had to manually create the parsing rules for a few of our vendors so that we could interpret the logs correctly. Most of them had already been pre-created for us.""Technical support has always been helpful.""What I found most valuable in LogRhythm NextGen SIEM is that it's user-friendly. I also like its dashboard, which shows all the logs and information I want to see.""It's reliable and the performance is good.""SOAR is integrated with the dashboard that we use for threat management. Because it's all integrated, it is useful for us when we deploy something on-prem.""It's positively affected our overall rate of efficiency.""Our clients enjoy having one dashboard to monitor their environments in real time.""The dashboards in the LogRhythm SIEM really help us as a starting point. It gives us a starting point we can go to every day. We walk through several dashboards to see anomalous activity for further investigation."

More LogRhythm SIEM Pros →

"One of the most valuable features of Microsoft Sentinel is that it's cloud-based.""We’ve got process improvement that's happened across multiple different fronts within the organization, within our IT organization based on this tool being in place.""The initial setup is very simple and straightforward.""There are a lot of things you can explore as a user. You can even go and actively hunt for threats. You can go on the offensive rather than on the defensive.""There are some very powerful features to Sentinel, such as the integration of various connectors. We have a lot of departments that use both IaaS and SaaS services, including M365 as well as Azure services. The ability to leverage connectors into these environments allows for large-scale data injection.""The AI and ML of Azure Sentinel are valuable. We can use machine learning models at the tenant level and within Office 365 and Microsoft stack. We don't need to depend upon any other connectors. It automatically provisions the native Microsoft products.""It is always correlating to IOCs for normal attacks, using Azure-related resources. For example, if any illegitimate IP starts unusual activity on our Azure firewall, then it automatically generates an alarm for us.""The most valuable feature is the onboarding of the workloads. You can see all that has been onboarded in your account on the dashboards."

More Microsoft Sentinel Pros →

Cons
"The integration with multiple sources could be better.""From the network segmentation side, there is some discrepancy in log onboarding. The tool needs to improve direct API integrations, login integration, native login integration, etc.""In my opinion, this solution has a steep learning curve and requires practice if users to be able to use this tool very efficiently.""The API integration in Sumo Logic Security could improve. There are delayed connections or they stop and then automatically start. Having a seamless log collection would be beneficial."

More Sumo Logic Security Cons →

"LogRhythm NextGen SIEM is currently based only on the Windows platform. This means that some of our customers have to purchase a Windows license elsewhere. If LogRhythm can move to a Linux platform or a proprietary platform, it would be very helpful.""When we originally got LogRhythm, their tech support was fantastic, and I loved them. Now, we don't quite get as quick of a response. I've been disappointed in the more recent tech support. When you call in, they'll say that they will get you somebody, and you'll finally get someone who will contact you back a day or so later. Whereas before, I would get help right away.""The customer support system is time-consuming.""There is room for improvement with separate running sources or better integration.""The security playbook could be pre-defined and available to other analysts with similar security issues.""The log storage capacity should be increased.""The solution is likely not the best option for a smaller organization.""One of the challenges of the SIEM for the LogRhythm 7 platform is the amount of time it takes to bring new log sources into the MDI."

More LogRhythm SIEM Cons →

"Microsoft Sentinel is relatively expensive, and its cost should be improved.""It would be good to have some connectors for third-party SIEM solutions. Many customers are struggling with the integration of Azure Sentinel with their on-premise SIEM. Microsoft is changing the log structure many times a year, which can corrupt a custom integration. It would be good to have some connectors developed by Microsoft or supply vendors, but they are not providing such functionality or tools.""Sometimes, we are observing large ingestion delays. We expect logs within 5 minutes, but it takes about 10 to 15 minutes.""If Sentinel had a graphical user interface, it would be easier to use. I would also like it to be more customizable.""If Azure Sentinel had the ability to ingest Azure services from different tenants into another tenant that was hosting Azure Sentinel, and not lose any metadata, that would be a huge benefit to a lot of companies.""I can't think of anything other than just getting the name out there. I think a lot of customers don't fully understand the full capabilities of Azure Sentinel yet. It is kind of like when they're first starting to use Azure, it might not be something they first think about. So, they should just kind of get to the point where it is more widely used.""The performance could be improved. If I create 15 to 20 lines for a single-use case in KQL, sometimes it takes more time to execute. If I create use cases within a certain timeline, the result will show in .01 seconds. A complex query takes more time to get results.""There are certain delays. For example, if an alert has been rated on Microsoft Defender for Endpoint, it might take up to an hour for that alert to reach Sentinel. This should ideally take no more than one or two seconds."

More Microsoft Sentinel Cons →

Pricing and Cost Advice
  • "The license pricing model is based on the events that are processed through the solution."
  • More Sumo Logic Security Pricing and Cost Advice →

  • "The setup and licensing for small and medium size businesses is straightforward, though when it comes to the enterprise it pays to keep in mind the possibility for complications given all the extras and add-ons that may be required."
  • "We work with French-speaking African countries, and it costs more than the average SIEM solution. Also, the pricing isn't too flexible. AlienVault, Splunk, and IBM QRadar are more suitable for customers on a tight budget."
  • "The support which allows more customized to the environment when we are deploying new systems is called Professional Service and is very expensive. The technical annual support and there is an annual fee."
  • "I would rate the pricing 4 out of 5. There are no additional costs to the standard licensing fees."
  • "It is a very cost-effective solution."
  • "NextGen SIEM's pricing is moderate."
  • "LogRhythm's licensing is based on MPS. There are some add-on features like advanced UEBA, the cloud component for advanced UEBA, and SIEM."
  • "LogRhythm's pricing and licensing is extremely competitive and it's one of the top three reasons we continue to invest in the platform."
  • More LogRhythm SIEM Pricing and Cost Advice →

  • "I have had mixed feedback. At one point, I heard a client say that it sometimes seems more expensive. Most of the clients are on Office 365 or M365, and they are forced to take Azure SIEM because of the integration."
  • "It is kind of like a sliding scale. There are different tiers of pricing that go from $100 per day up to $3,500 per day. So, it just kind of depends on how much data is being stored. There can be additional costs to the standard license other than the additional data. It just kind of depends on what other services you're spinning up in Azure, or if you're using something like Azure log analytics."
  • "I am just paying for the log space with Azure Sentinel. It costs us about $2,000 a month. Most of the logs are free. We are only paying money for Azure Firewall logs because email logs or Azure AD logs are free to use for us."
  • "Sentinel is a bit expensive. If you can figure a way of configuring it to meet your needs, then you can find a way around the cost."
  • "Azure Sentinel is very costly, or at least it appears to be very costly. The costs vary based on your ingestion and your retention charges."
  • "Sentinel can be expensive. When you ingest data from sources that are outside of the cloud, you're paying a fair amount for that data ingestion. When you're ingesting data sources from within the cloud, depending on what your retention periods are, it's not that expensive."
  • "I have worked with a lot of SIEMs. We are using Sentinel three to four times more than other SIEMs that we have used. Azure Sentinel's only limitation is its price point. Sentinel costs a lot if your ingestion goes up to a certain point."
  • "Pricing is pay-as-you-go with Sentinel, which is good because it all depends on the number of users and the number of devices to which you connect."
  • More Microsoft Sentinel Pricing and Cost Advice →

    report
    Use our free recommendation engine to learn which Security Information and Event Management (SIEM) solutions are best for your needs.
    708,544 professionals have used our research since 2012.
    Questions from the Community
    Top Answer:The most valuable features of Sumo Logic Security are the rules, use cases, and ease of use. Additionally, the… more »
    Top Answer:The license pricing model is based on the events that are processed through the solution. The price of Sumo Logic… more »
    Top Answer:The API integration in Sumo Logic Security could improve. There are delayed connections or they stop and then… more »
    Top Answer:Rony, Daniel's answer is right on the money.  There are many solutions for each in the market, a lot depends upon your… more »
    Top Answer:LogRhythm does a very good job of helping SOCs manage their workflows.
    Top Answer:LogRhythm's pricing and licensing are extremely competitive and it's one of the top three reasons we continue to invest… more »
    Top Answer:Yes, Azure Sentinel is a SIEM on the Cloud. Multiple data sources can be uploaded and analyzed with Azure Sentinel and… more »
    Top Answer:It would really depend on (1) which logs you need to ingest and (2) what are your use cases Splunk is easy for… more »
    Top Answer:We like that Azure Sentinel does not require as much maintenance as legacy SIEMs that are on-premises. Azure Sentinel is… more »
    Comparisons
    Also Known As
    LogRhythm NextGen SIEM, LogRhythm, LogRhythm Threat Lifecycle Management, LogRhythm TLM
    Azure Sentinel
    Learn More
    Overview

    Sumo Logic empowers the people who power modern, digital business. Our cloud-native SaaS analytics platform powered by logs helps customers deliver reliable and secure cloud-native applications. With Sumo Logic, practitioners and developers can ensure application reliability, secure and protect against modern threats and gain insights into their cloud infrastructures. Customers worldwide rely on our scalable platform to get powerful real-time analytics and insights across observability and security solutions for their cloud-native applications. For more information, visit: SUMOLOGIC.COM

    LogRhythm SIEM Platform is an award-winning platform in security analytics. With more than 4,000 customers globally, LogRhythm SIEM is an integrated platform that helps security operations teams protect critical infrastructure and information from emerging cyberthreats. Ultimately, LogRhythm SIEM is an integrated set of modules that contribute to the security team’s fundamental mission: rapid threat monitoring, threat detection, threat investigation, and threat neutralization. LogRhythm SIEM is for organizations that require an on-premises solution and offers:

    ● Streamlined workflow

    ● Secure data access

    ● Real-time visibility

    ● A unified user experience

    ● Management customization

    Security information and event management (SIEM) solutions have been evolving for over a decade; their core functionality still acts as the most effective foundation for any organization’s technology stack. A SIEM solution enables an organization to centrally collect data across its entire network environment to gain real-time visibility into activity that may pose a risk to the organization. SIEM technology addresses threats before they become significant financial risks while simultaneously helping better manage an organization’s assets.

    LogRhythm SIEM has many key features and capabilities, including:

    High-Performance Log Management: LogRhythm SIEM offers structured and unstructured search capabilities which allows users to swiftly search across an organization’s vast data to easily find answers, identify IT and security issues, and troubleshoot issues. Users can efficiently process and index terabytes of log data daily.

    Network and Endpoint Monitoring: Forensic sensors allow users to gain deep visibility into endpoint and network activity. Users can see behavioral anomalies and better respond to incidents.

    SmartResponse™ Automation: LogRhythm SIEM allows users to centrally execute pre-staged actions that automate incident investigatory tasks and responses.

    Automated Machine Analytics: LogRhythm SIEM's AI Engine continuously analyzes all collected security incidents and forensic data. Security teams are delivered precise, real-time intelligence about risk-prioritized threats.

    Case and Security Incident Management: LogRhythm SIEM offers an integrated workflow so that threats don’t slip through the cracks. Collaboration tools help centrally manage and track investigations.

    User and entity behavior analytics (UEBA): Embedded deterministic UEBA monitoring helps protect against insider threats.

    Security orchestration, automation, and response (SOAR): LogRhythm SIEM includes our embedded SOAR solution to increase efficiency and higher-quality incident response with low mean time to response (MTTR).

    Benefits to Using LogRhythm SIEM

    The platform offers great value to security and IT operations. Users have the ability to map their security and IT operations to existing frameworks such as NIST and MITRE ATT&CK.

    ● The platform offers broad integration across security and IT vendors: Users benefit from support for integration with hundreds of security and IT solutions. In turn, this further extends SIEM capabilities and data collection.

    ● The platform provides compliance adherence, enforcement, and reporting: The prebuilt compliance modules automatically detect violations as they occur and remove the burden of manually reviewing audit logs.

    Reviews from Real Users

    LogRhythm SIEM stands out among its competitors for a number of reasons. Two major ones are its ability to be customized and its quick performance of queries.

    Jason G., a senior cybersecurity engineer, writes, "I have found the Advanced Intelligence Engine has provided the most value to us because we can customize alarms based on our requirements and have created hundreds of alarms that notify different people for different scenarios."

    Andy W., principal consultant at ITSEC Asia, notes, “LogRhythm SIEM covers all our primary security analysis needs. It makes it easier for us to analyze threats and improves our response times. It's a versatile platform that performs queries fast compared to other SIEM solutions.”

    Microsoft Sentinel is a scalable, cloud-native, security information event management (SIEM) and security orchestration automated response (SOAR) solution that lets you see and stop threats before they cause harm. Azure Sentinel delivers intelligent security analytics and threat intelligence across the enterprise, providing a single solution for alert detection, threat visibility, proactive hunting, and threat response. Eliminate security infrastructure setup and maintenance, and elastically scale to meet your security needs—while reducing IT costs. With Azure Sentinel, you can:

    - Collect data at cloud scale—across all users, devices, applications, and infrastructure, both on-premises and in multiple clouds

    - Detect previously uncovered threats and minimize false positives using analytics and unparalleled threat intelligence from Microsoft

    - Investigate threats with AI and hunt suspicious activities at scale, tapping into decades of cybersecurity work at Microsoft

    - Respond to incidents rapidly with built-in orchestration and automation of common tasks

    To learn more about our solution, ask questions, and share feedback, join our Microsoft Security, Compliance and Identity Community.

    Offer
    Learn more about Sumo Logic Security
    Learn more about LogRhythm SIEM
    Learn more about Microsoft Sentinel
    Sample Customers
    Macy's, NASA, Fujitsu, US Air Force, EY, Abbott, HD Supply, SAB Miller, UCLA, Raytheon, Amtrak, Cargill
    Microsoft Sentinel is trusted by companies of all sizes including ABM, ASOS, Uniper, First West Credit Union, Avanade, and more.
    Top Industries
    REVIEWERS
    Financial Services Firm33%
    Media Company22%
    Transportation Company11%
    Comms Service Provider11%
    VISITORS READING REVIEWS
    Computer Software Company17%
    Financial Services Firm11%
    Government9%
    Manufacturing Company7%
    REVIEWERS
    Financial Services Firm26%
    Healthcare Company12%
    Energy/Utilities Company9%
    Manufacturing Company8%
    VISITORS READING REVIEWS
    Educational Organization32%
    Computer Software Company12%
    Government8%
    Financial Services Firm5%
    REVIEWERS
    Financial Services Firm22%
    Manufacturing Company7%
    Comms Service Provider7%
    Computer Software Company7%
    VISITORS READING REVIEWS
    Computer Software Company18%
    Government10%
    Financial Services Firm9%
    Comms Service Provider6%
    Company Size
    REVIEWERS
    Small Business25%
    Midsize Enterprise6%
    Large Enterprise69%
    VISITORS READING REVIEWS
    Small Business24%
    Midsize Enterprise17%
    Large Enterprise60%
    REVIEWERS
    Small Business21%
    Midsize Enterprise22%
    Large Enterprise57%
    VISITORS READING REVIEWS
    Small Business18%
    Midsize Enterprise42%
    Large Enterprise41%
    REVIEWERS
    Small Business33%
    Midsize Enterprise20%
    Large Enterprise47%
    VISITORS READING REVIEWS
    Small Business22%
    Midsize Enterprise16%
    Large Enterprise62%
    Buyer's Guide
    LogRhythm SIEM vs. Microsoft Sentinel
    May 2023
    Find out what your peers are saying about LogRhythm SIEM vs. Microsoft Sentinel and other solutions. Updated: May 2023.
    708,544 professionals have used our research since 2012.

    LogRhythm SIEM is ranked 6th in Security Information and Event Management (SIEM) with 28 reviews while Microsoft Sentinel is ranked 2nd in Security Information and Event Management (SIEM) with 56 reviews. LogRhythm SIEM is rated 8.2, while Microsoft Sentinel is rated 8.4. The top reviewer of LogRhythm SIEM writes "Helps with productivity, reduces administrative overhead, and offers useful dashboards". On the other hand, the top reviewer of Microsoft Sentinel writes "A straightforward solution that provides comprehensiveness and coverage of multiple different on-prem, and cloud solutions". LogRhythm SIEM is most compared with Splunk Enterprise Security, IBM Security QRadar, Elastic Security, Wazuh and Graylog, whereas Microsoft Sentinel is most compared with AWS Security Hub, Splunk Enterprise Security, IBM Security QRadar, Elastic Security and Fortinet FortiSIEM. See our LogRhythm SIEM vs. Microsoft Sentinel report.

    See our list of best Security Information and Event Management (SIEM) vendors.

    We monitor all Security Information and Event Management (SIEM) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.