Microsoft Sentinel Reviews

Microsoft Defender for Cloud's bi-directional sync capabilities are important in the following way. If you have an issue that shows in Defender for Cloud, an incident on your dashboard, and you look into Sentinel and see the same alert has been triggered, after someone on your team looks into it and fixes it, if bi-directional is not enabled, you will still have the alert showing. If someone is looking at the Defender for Cloud dashboard, that alert will still show as active. That's why it's important to have bi-directional sync. It helps make sure that people work on the right cases.

Sentinel enables you to investigate threats and respond holistically in one place. It gives you a central repository where you can have a historical view and see the access point where something started, where it went, and how things were accessed. For instance, if someone was anomalously accessing keywords, with everything in one place you can see where it started, where it went, who was involved in it, what kind of endpoints were involved, what IP address was involved, and what devices were involved. In this way, you have complete historical data to investigate the root cause.

Previously, I worked with a number of different tools to pull the data. But having one pane of glass has obviously helped. When you consider the time it takes to go into each and every dashboard and look into alerts, and take the necessary actions, Sentinel saves me a minimum of 15 minutes for each dashboard. If you have three to four dashboards altogether, it saves you around one hour.

And when it comes to automating routine tasks, if you want to notify the right people so that they can look into a P-1 incident, for example, Sentinel can automatically tag the respective SOC or security incident teams through a team chart and they can directly jump into a call.

Another point to consider is multi-stage attack detection. We have a granular view into the incident. We can investigate which IPs, user entities, and endpoints are involved in the alert. If you have to look at multiple, separate points, it could take one hour to see what happened at a particular point in time. With Sentinel, we can directly look into a certain person and points and that saves a lot of time. And then we can take action on the incident.

Among the valuable features of Sentinel are that it 

• has seamless integration with Azure native tools 
• has out-of-the-box data connectors available
• is user-friendly
• is being expanded with more updates.

The visibility into threats that the solution provides is pretty good. We can see a live attack if something is going wrong; we can see the live data in Sentinel.

I work on the complete Azure/Microsoft stack. With Azure native, we can integrate the various products in a few clicks. It doesn't require configuring a server, pulling of logs, or other heavy work. It's very easy, plug-and-play. The data collectors are available with Azure native so you can deploy policies or it will take care of everything in the backend. If various tools have different priorities for issues, monitoring everything is a hectic task. You have to go into each tool and look into the alerts that have been triggered. It's a big task. If you can integrate them into a single pane of glass, that helps you to find out everything you need to know.

And in terms of the comprehensiveness of the threat protection that these products provide, I would give it a 10 out of 10.

Microsoft Sentinel enables you to ingest data from the entire ecosystem and that connection of data helps you to monitor critical resources and to know what's happening in the environment. At a minimum, we should monitor the servers that are critical in the environment.

It also has hunting capabilities so that you can proactively hunt for things, but a different team looks after that in our organization.

In terms of features I would like to see in future releases, I'm interested in a few more use cases around automation. I do believe a lot of automation is available, and more is in progress, but that would be my area of interest.

I have been using Microsoft Sentinel for more than two and a half years.

It's a stable solution.

It's a scalable model but as you scale up you pay for it.

Microsoft technical support is responsive and helpful. And their technical documents are pretty detailed and well-explained.

Positive

The initial deployment was pretty straightforward.

The number of people involved in the deployment is completely dependent upon the environment and the access we have. If there's something to be done with a third-party application—for instance, Cisco Meraki or ASA—for those, we require support from the networking team to open up ports and forwarding of logs from the firewalls to Sentinel. If it is a native Azure environment, we don't need any support.

As for maintenance, if there are any updates they will pop up in your alerts and you can then upgrade to the latest version. It doesn't take much effort and there is no downtime. You simply update and it takes a few seconds. If someone is experienced, that person can handle the maintenance. If the environment is very big and it requires injecting more logs, then it requires some helping hands.

The pricing is fair.

With a traditional SIEM, people are required for SOC operations and investigations and they require licenses. With Sentinel, people in SOC operations are still required to investigate, but we don't need any licenses for them. With a traditional SIEM, you pay a lump sum for licenses. But with Sentinel, it's pay-as-you-go according to the amount of data you inject.

I would recommend Microsoft Sentinel.

It's always good to compare against other tools when it comes to the value, to get an idea of what you are paying for. Compare the market strategies and the new capabilities that are coming out and whether you're able to unlock the full capabilities or not. Double-check that. As for best-of-breed versus one vendor, you should stick with one vendor only and take whatever they gave.

Our customers primarily use the solution to monitor their infrastructure locally.  Some of our customers want to monitor logs to find some abnormal instances, so, they use Microsoft Sentinel to identify threats or identify what is happening in their infrastructure.

Microsoft Sentinel is easy to use compared to some third-party solutions, for example, if we want to get a log using a lot of the third-party solutions it is very difficult because we have to configure it. But in Microsoft Sentinel, if you want to get a log, you just click next, next, next, and see the log. It's straightforward to use the solution. Microsoft Sentinel is on the cloud, so we don't need to maintain a lot of the OS issues we have with other products. Sometimes SIEM has problems that require a lot of maintenance to resolve the OS issues and that takes a lot of time to deal with, but the Microsoft Sentinel benefit is you're on the Cloud. We don't have to spend time dealing with OS issues. We can use that time to focus on critical incidents.

The most valuable features in my experience are the UEBA, LDAP, the threat scheduler, and integration with third-party straight perform like the MISP.

The product can be improved by reducing the cost to use AI machine learning. In my experience in Taiwan, if you want to use Microsoft machine learning for Microsoft Sentinel, the cost is high. The high cost keeps customers from using the feature.

Currently, I think that the customized log can be improved because I check some documents, and Microsoft Sentinel can only customize some file logs. If some logs can be in a database or some user Syslog for all the events in Microsoft Sentinel to be supported. I can't choose to parse the log. I hope Microsoft Sentinel can support more and more different event types for customization. The solution ends up passing a lot of the logs.

I have been using Microsoft Sentinel for 13 months.

The solution is very stable.

The solution is easy to scale.

Technical support uses a ticket system. We just use the portal and I can open a ticket for them, and they will respond back to us. The technical support team is very good they solve a lot of the issues for us, or help us solve a lot of issues, but sometimes the issues can be more complicated and they cannot help us. If I submit a complicated ticket to technical support and they still don't know how to resolve it we are required to use premium support and that option comes with an additional fee. If you have less complicated issues free technical support can resolve the ticket but with more complex tickets you need to use the premium service.

Positive

The initial setup is very easy we just choose where to create, and then next, done, finished. Very easy. The deployment took less than five minutes and only required one person.

The implementation was completed in-house on my own. I just studied Microsoft documents and trained myself. If I still don't know something, I open a ticket to Microsoft to get some help.

The solution is expensive and there is a daily usage fee.

I give the solution an eight out of ten.

I am a third-party user of the solution, but if I were an outside user of Microsoft Sentinel, I really like it because they have a lot of the functions that others don't have. Things like the UEBA and intelligence from Microsoft. Microsoft has already studied a lot of threat intelligence, and they have the capability to help us detect what kind of content will match Microsoft intelligence. I like this and also has a lot of AI machine learning. This will help me to review or, learn easily. I hope this product will help me with a lot of things.

The solution states that it provides good visibility into threats by identifying vulnerabilities. I'm not clear on the vulnerability feature. I am not sure if most customers are familiar with the feature. I believe the feature is used to detect a lot of threats, but what kind of vulnerability? I am still not familiar with the feature.

I think because our enterprise has a lot of different Standard Operating Procedures it depends on the customer, for example, the solution helps detect ransomware, and that helps the organization prioritize dealing with the ransomware situation above other threats.

We have one customer that has implemented Microsoft Security E5. That means they also have Microsoft Defender 365. They use this to detect their infrastructure and their endpoints as well as if they have a SaaS platform they can monitor abnormal behavior.

I have integrated Microsoft Sentinel and Microsoft Defender 365, and they are very easy to integrate. They also have a correlate function and they have rules called Fusion. This Fusion function helps us investigate the correlation between the products.

Because my job is to help the customer integrate, I don't know how well the solutions work together to deliver detection and response for our customers. I am not involved once the solutions are deployed.

In Taiwan, we don't have customers that use Microsoft Defender for Cloud but I use it in my lab.

Some of our customers have additional solutions that are not Mircosoft. I have some customers, who have some data from the Microsoft device, from Windows and maybe events, and others that are not Microsoft products. The customers use their own on-premise, third-party products and buy their solutions. Hence, it is difficult to say if Microsoft Sentinel enables us to ingest data from the whole enterprise.

You can investigate the threats and respond from one place using Microsoft Sentinel. We should report correlation too. It's effortless to investigate responses in Microsoft Sentinel.

In Taiwan, we don't believe in automating routine tasks. There are a lot of things we still do manually and are not using the automated function of Microsoft Sentinel except to send mail.

With Microsoft Sentinel, we use one unified dashboard that is very easy.

We don't use the threat intelligence from Microsoft Sentinel because it is not public, so when a threat is detected that matches the Microsoft database threat intelligence, they only send us an alert, but they don't provide the content inside. Instead, we use open-source threat intelligence and integrated it into the solution.

Using Microsoft Sentinel has reduced the time spent per incident from three hours to one and a half to two hours.

The solution has not saved any money because it is still expensive. We have a large customer demand but all the vendors are as expensive as Microsoft Sentinel. I think they are very expensive. The solution has a daily usage charge.

Depending on the rule being used the solution can save us time in detecting incidents or threats. I can say we just use the default, sometimes it's very long and doesn't really take a lot of time. We get the result to tell me, "Oh. You have an incident happen." But I still don't know why Microsoft usually misses the threats. I still don't know why they design it like this, because I have had some instances in my past experience where the rule is if a threat is detected we must immediately alert first. Perhaps the detection module for Microsoft Sentinel is old. It starts to already alert us and that is a default rule. So, I still don't know why Microsoft Sentinel was created like this. I still don't understand. If you use a UEBA, to detect some threats in some abnormal behavior it's very fast, but if you use the scheduler to detect a lot, sometimes it takes a long time.

In my experience, everything is working and the solution doesn't have any bugs.

The solution is only released on the cloud on Azure. You can't deploy the solution on-premise.

Currently, I only deploy in a single environment. I don't have another environment because almost all our customers use a single environment. Perhaps in the future, they will add another cloud that will use Microsoft Sentinel. That is a very long time in the future. In my experience, the solution is used only in a single environment. We have two people in our organization that use the solution and four to five large customers.

Since Microsoft Sentinel is cloud-based it updates automatically and requires no maintenance from our end.

I think I'm more likely to use a single vendor over using a best-of-breed strategy because a single vendor, integrates together all of the things. I don't need to customize. Trend Micro doesn't understand Microsoft products, and Microsoft products, don't know Trend Micro products. If I choose to use a single solution that means they will handle all of those things. I don't need to use or take the time to customize some functions. I don't need to do that. I prefer to use a single vendor.

If a customer is already using a lot of Microsoft solutions I would recommend Microsoft Sentinel because it is very easy to integrate, but if a customer is using multiple different third-party security solutions I would not recommend Microsoft Sentinel because it will take more time to integrate it and check everything.

We are using mixed solutions. We are currently working with IBM solutions and Azure system services. We are using two SIEM solutions: Azure Sentinel and QRadar. Azure Sentinel is covering our cloud-based solutions, and QRadar is covering our on-premise solutions.

The best functionality that you can get from Azure Sentinel is the SOAR capability. So, you can estimate any type of activity, such as when an alert was triggered or an incident was found.

It integrates with Azure AD, Power BI, and other Microsoft solutions. It is very good in our view.

It would be good to have some connectors for third-party SIEM solutions. Many customers are struggling with the integration of Azure Sentinel with their on-premise SIEM. Microsoft is changing the log structure many times a year, which can corrupt a custom integration. It would be good to have some connectors developed by Microsoft or supply vendors, but they are not providing such functionality or tools.

It can be expensive for customers. Currently, we are not using Sentinel to collect logs from on-premise devices. The main reason for that is the budget because you need to pay for the internet traffic. You also need to calculate how much you can upload to the Azure site. 

I have been using this solution for one year.

It is stable, but it is also related to your country. I'm working in Kazakhstan, and sometimes, we have some problems with the internet connection at the government level. Sometimes, for some reason, which could also be political, they disable the internet connection, and we lose the connection to the Azure environment. It might be good for our country to have a private link to the Azure cloud environment to avoid such cases.

We have a lot of Microsoft partners who are helping us. Therefore, support is not a problem for us.

We have QRadar for our on-premise solutions. QRadar has a lot of connectors out of the box. It has a lot of predefined and pre-deployed connectors that you can use. 

QRadar also has a lot of good correlation rules. From a customer's point of view, it is one of the best solutions because you don't need to create correlation rules from scratch. You just review them and customize them as you want.

QRadar supports using SQL queries. Sentinel uses KQL, but you need to learn it from scratch.

QRadar doesn't have a SOAR system by default. You need to purchase it additionally, which is the main problem with QRadar.

It was easy.

We had some introduction to the system from a Microsoft Partner, but most of the analytics and playbooks were created by us.

For us, it is not expensive at this time, but if we start to collect all logs from our on-premise SIEM solutions, it will cost more than QRadar. If we calculate its cost over the next five or ten years, it will cost more than what we paid for QRadar.

Microsoft is proposing an identity management solution for Azure Active Directory systems and the Azure Cloud system, but we need an on-premise solution that can help us achieve the same with, for example, IBM. I know that Microsoft has a cloud-based solution, and previously, Microsoft provided an on-premise solution, but it is deprecated or no longer supported. It will be good to have such a service on-premises.

I would rate it an eight out of ten.

I support Microsoft Sentinel as a Microsoft partner. We work on various scenarios, such as emails and data connectors. I support licenses by helping them enroll and advising them on the prerequisites they need to meet. I show them how to get started with Microsoft Sentinel. 

I'm the technical lead for Microsoft, so I've worked on several Microsoft security products, including Sentinel, Cloud App Security, Defender, Azure Information Protection, and Azure Key Vault. These are now my significant areas. It wasn't easy to integrate Sentinel with other products initially, but we had a smooth experience once the data connectors and everything were in place.

We are from the support team, so we operate in multiple environments depending on the use case. It works smoothly in every environment, including hybrid ones.

I've seen scenarios where the customer's security score was at 60, but we managed to increase it to 80 or 90 based on the recommendations from Sentinel. We use Sentinel to investigate the activity logs and address the issues. The security score increases once we fix those. 

The benefit Sentinel provides depends on the organization and how they have recruited engineering staff. If the engineers can maintain two or three products, then it's easy for them, but it hasn't reduced any difficulty from my perspective. 

Sentinel saved us time. When this product was introduced, many customers used other SIEM and SOAR technologies separately. Now that we have Sentinel in place, customers only need to learn how to use this product, so it's 50% to 60% more efficient. It's also more cost-effective because you aren't paying separately for those security components. Sentinel is all-inclusive. 

Sentinel integrates seamlessly with Azure platform services, making it more reliable and cost-effective. I can't say with certainty because it's outside my department, but my best guess is that Sentinel can reduce costs by about 30% to 40%. I would also estimate that it reduces our response time by roughly that amount. 

The bidirectional sync capabilities ingest the data and show us alerts that help us prioritize our policy settings and secure our environment. Once we ingest the IP address, we can monitor the network traffic. It ingests everything from the IP address to the applications we use at the cloud level. Having every event, alert, and output from Log Analytics integrated into one platform is essential. We can ingest everything using the syslogs and data connectors. For example, I'm using Windows Server 2016. It will send the data to the cloud, and Microsoft Sentinel pulls it from there. It removes the sysadmin logs and the other logs, so we can easily see the DDoS attacks and other threats.

It ingests the networking stuff and other things, too. It collects everything the company needs to secure the data from data engineers, Log Analytics engineers, information production engineers, etc. It ingests data from everywhere and stores it in one place. You can pull whatever data you need. 

A security product must be integrated with multiple other technologies like SIEM and SOAR to give you the best results and analyze user behavior. Sentinel uses connectors to integrate all Azure products and third-party security tools.

Sentinel provides excellent threat visibility, enabling us to dig deep. It directly connects to Azure Log Analytics, allowing us to do research and pull logs. It uses SOAR intelligence to detect and fix issues using AI and machine learning algorithms.

The ability of all these solutions to work together natively is essential. We have an Azure subscription, including Log Analytics. This feature automatically acts as one of the security baselines and detects recommendations because it also integrates with Defender. We can pull the sysadmin logs from Azure. It's all seamless and native. 

Everything shares a common database so that every product can be integrated depending on your enterprise licenses. Microsoft is effortless from a customer's perspective. You get a wide range of features with one license, including threat detection, information protection, infrastructure solutions, and endpoint protection. One or two enterprise licenses cover everything. 

Sentinel is an excellent product with multiple dashboards if you want to look at something specific. It also has a centralized dashboard for everything if you want to see the overview of what's essential. I use multiple dashboards because it's easier for us as support team members. 

Microsoft Defender has a built-in threat expert option that enables you to contact an expert. That feature isn't available in Sentinel because it's a huge product that integrates all the technologies. I would like Microsoft to add the threat expert option so we can contact them. There are a few other features, like threat assessment that the PG team is working on. I expect them to release this feature in the next quarter.

I have been using Microsoft Sentinel for two-and-a-half years

Sentinel is stable. 

I rate Microsoft technical nine out of 10. 

Positive

Setting up Microsoft Sentinel is straightforward because it's a cloud platform. You can install it with a few clicks. It isn't like the on-premises solutions we have used in the past, where you need to spend a couple of hours. You can deploy Sentinel with one person in around five minutes if you have all the resources, permissions, and rules.

Like all products, Sentinel requires some maintenance. There are planned and unplanned outages. Depending on when Microsoft releases the updates, it can be challenging, but they usually notify us ahead of time.

Microsoft offers the best value from a customer perspective.  With a small amount of money, customers can take advantage of an array of technologies because everything is connected from the Microsoft perspective. The return on investment is massive. You don't need to recruit multiple engineers. One engineer who is familiar with Microsoft products can manage the solution. 

I think Sentinel's pricing is reasonable. It's more reliable if it can integrate with other enterprise technologies, so you have to pay for that. We have to consider the size of the organization. We might shift to other security products for a smaller company. Given the reliability of Microsoft support, Sentinel is cost-effective.  

Sentinel is one of the best products compared to other SIEM solutions like CyberArk. Microsoft's market share is enormous, and they have surpassed AWS, so more companies are adopting Sentinel. A company can centralize everything with Sentinel, and that's great from a cost perspective. 

I rate Microsoft Sentinel nine out of 10. I see a few areas of improvement, but they are already working on implementing these features. If someone asked me whether I would recommend an a la carte approach using the best-in-breed solutions or an all-in-one integrated package from a single vendor, I would say that both approaches have advantages. However, I think it's good to hand everything over to the vendor. A vendor will take the sole responsibility and do the work for you. 

I also recommend becoming an expert in Microsoft Sentinel because it has a bright future. You can earn a decent salary once you have hands-on experience with this product. Sentinel is not well known, but I think it will have 60 to 70 percent of the market share.

We use it to protect our Office 365 environment. We can also deploy it for the entire infrastructure, including on-premises, firewalls, and also users' devices.

I'm a partner with many customers using Sentinel. Some are small companies but I also have many banks that have implemented the solution.

It has helped to improve security posture because it's based on machine learning. You can protect the whole environment. While other solutions are based on rules, and you have to put rules in place to protect things, Sentinel is smarter because of the machine learning.

For example, one of my customers is a bank that was attacked by ransomware. They were using Symantec and it could not detect the attack. When we put in Sentinel, within 15 minutes it detected the malware and stopped the attack.

The most valuable features are its threat handling and detection. It's a powerful tool because it's based on machine learning and on the behavior of malware.

I have been using Microsoft Sentinel for one and a half years.

It's a stable solution.

It's a cloud solution so Microsoft handles the scaling. We haven't had a problem with performance because Microsoft is in charge. It's done automatically.

It's definitely the best technical support. When you open a new ticket you get a response within a maximum of one hour. You can open a case with Microsoft 24/7.

Positive

I used QRadar. I switched because QRadar is not smart and there was too much manual work.

It's easy to implement and not very hard to put it into production.

The deployment time depends on the customer's needs. It can be deployed in one hour. But if they have many end users and many servers, it can take one week. After that, you have to wait for the machine learning to learn the environment and start the detection.

The implementation strategy also depends on the environment. If it is an Office 365 environment, we can start by protecting email, the shares, and the docs. After that, we can move to the end-user machines. But it depends on the project.

Deployment and maintenance requires a maximum of three people. One would be an admin, one would be a security leader to maintain the solution, and the third would be a project manager. It also depends on the project, but in general, there will be two or three people involved.

It is certainly the most expensive solution. The cost is very high. We need to do an assessment using the one-month trial so that we can study the cost side. Before implementing it, we must do a careful calculation.

Something that could be improved is the documentation of the cost because there is none. All the other features are documented, but the pricing is not very clear.

The Office 365 connectors to Sentinel are free, as is the support.

Sentinel is generally the last option we go with because of the cost. Customers have their solutions but they contact us and say, "Okay, we have our solution but it's not smart. Can we move to Sentinel?"

I recommend implementing Sentinel because it's certainly the most powerful SIEM tool. It detects all malware based on the behavior of many things, including the files and anomalies. It detects things automatically.

We use it to monitor the cloud for any security issues. We are using it as a SIEM for our cloud workspace.

The most valuable feature is the UEBA. It's very easy for a security operations analyst. It has a one-touch analysis where you can search for a particular entity, and you can get a complete overview of that entity or user.

There is also something called workbooks in Sentinel that help us to monitor the complete cloud data and it gives knowledge about, and visibility into, our security posture.

It integrates seamlessly with Microsoft products, especially Office 365 and our Azure workspace, whether it's the Application Gateway or Azure DDoS or Azure Firewall. It has native integration that works very well.

You can also monitor Zero Trust security from Microsoft Sentinel.

There are a number of points they can improve. For example, if I see an alert and I want to drill down and get more details about the alert, it's not just one click. In other SIEM tools, you just have to click the IP address of the entity and they give you the complete picture. In Sentinel, you have to write queries or use saved queries to get details. For a security analyst, when there is an incident, it takes a lot of time to write queries, investigate, and then execute.

For example, if you want to search a particular entity or an IP address, or search the complete log instead of just the security alerts, it takes time to write a query for that. The MTTR is a little high, as is the mean time to investigate, compared to other SIEM tools.

I would also like to have more resources on KQL queries.

And using the data connectors is not straightforward when you want to create a use case that is not out-of-the-box. Creating a custom use case is a challenging process. You need to understand KQL queries and the support for regex is limited.

I've been using Microsoft Sentinel for between six months and a year.

The availability is good. But when you compare the stability with Splunk or ELK or QRadar, it still needs to be more reliable and stable, not from an installation or administration perspective, but when it comes to security operations.

We collect data from between 3,000 and 4,000 users, and our cloud workspace is somewhere around 100 or 200 servers.

The scalability is good because it has Azure in the back end.

We are still deciding whether to migrate completely to Sentinel or not. We are using two SIEM solutions in parallel. The other solution is LogRhythm. From an analyst perspective, Sentinel has to evolve more. Once it does, we can think of migrating to it fully.

The installation was straightforward and easy. With Azure Resource Manager, it was easy to deploy, and it was a straightforward integration, in terms of configuration, to connect the Log Analytics workspace with Sentinel and the solutions that Sentinel has.

Deploying the solution hardly took four hours, and the initial configuration took a single person one day, meaning eight hours.

We used to have an on-prem solution and we moved our workload to the cloud. Our users did not face any challenges or difficulties as a result.

We are still in the process of getting our ROI. We are waiting for the solution to improve and mature.

Sentinel is pretty competitive. The pricing is at the level of other SIEM solutions.

I have experience with Splunk and QRadar and they are the best. They are equivalent, one with the other. Both the solutions are mature enough, having been in the market for quite some time. They know what they're doing and are easy to use from an analyst's perspective. Both are scalable solutions as well.

The drawback of these two solutions is that it takes a little bit of time to do integrations, especially for Azure workloads, as they're not in-built in Azure.

Always record your KQL queries and stick to the basics.

We provide managed security services to customers in Myanmar using Microsoft Sentinel as a cloud media SIEM. Most of the use cases involve retention, and we use all the features of Microsoft Sentinel. We also use other Microsoft security products like Defender for Endpoint, and most of them are integrated with Sentinel. 

Microsoft Sentinel is a cloud-native SIEM solution, so it helped us reduce our infrastructure costs and deliver better services to our customers. We don't need to pay upfront costs because it is in the cloud. We used an open-source SIEM solution before implementing Microsoft Sentinel, but that wasn't satisfactory for our customers. Sentinel helped us provide more robust managed security services to our customers.

It consolidated multiple dashboards into one and helped us be more proactive. However, our team is still trying to mature to a level that we can adopt a more preventative approach to security. Sentinel significantly reduced our detection time. Without Microsoft Sentinel, our SOC analyst might take 30 minutes to an hour to detect an issue, but now it's practically in real-time. 

The biggest advantage of Sentinel is scalability. In addition, we don't need to worry about paying for infrastructure costs upfront. It gives us the flexibility to choose the kind of infrastructure based on each client's needs. Sentinel is also much simpler than other SIEM solutions. The UI is smoother and easier to use.

Native integration with Microsoft security products or other Microsoft software is also crucial. For example, we can integrate Sentinel with Office 365 with one click. Other integrations aren't as easy. Sometimes, we have to do it manually. 

The bi-directional sync is helpful. For example, we have one client using our managed security service, but they don't want to use Microsoft Sentinel. If those products are not syncing or if the solution is not bi-directional, some alerts may be missed. It's essential for both portals and the two folders to be in the same channel it's pushing. The UEBA features are also perfect. We don't see the same caliber of user behavior analytics in other SIEM. Microsoft's UEBA is great for our SOC analysts. 

Microsoft threat intelligence and UEBA still have some room for improvement. There are currently only two connectors available for Microsoft threat intelligence. the threat intelligence platform and the FTIA commander.
Sentinel should offer another option for a third-party threat intelligence platform. There are lots of open-source threat intelligence solutions available. 

Threat handling could be great for our team and for our SOC analyst, but some are unusable depending on our SOC analytics.

Sentinel can ingest data from most of our ecosystem, but some data cannot be called up. For example, if an SAP product is hosted, it will do a specific version, but it cannot be called back to Sentinel. It cannot be directly connected to Sentinel.

Our team has been using Microsoft Sentinel for about two and a half years.

I rate Microsoft support a seven out of ten. They take too long to respond, but sometimes they are great. 

Neutral

We previously had an open-source SIEM, but it lacked the detection and automation capabilities of Sentinel.

The initial deployment was straightforward but configuring integration for some of our projects was challenging because there are few connectors for solutions like Cisco. I rate Sentinel a five out of ten for ease of setup. 

We performed our integration in-house, but sometimes we get support from Microsoft.

Sometimes, it is hard for us to estimate the costs of Microsoft Sentinel.

I rate Microsoft Sentinel a nine out of ten. I recommend it, but it takes time to evaluate because Sentinel is unlike other cloud solutions. 

We use Microsoft Sentinel for providing managed services and for security use cases, which include detecting anomalies or security events and collecting security events from various data sources.

What is most useful, is that it has a good connection to the Microsoft ecosystem, and I think that's the key part. If you are running the Microsoft ecosystem, you are running Azure and Microsoft 365 and have all of the security providers in that environment, for example, the E5 license, then Sentinel can easily collect those events and handle them within the same Azure environment. That, I believe, is the key point here.

Multi-tenancy, in my opinion, needs to be improved. I believe it can do better as a managed service provider.

It's a fairly mature product now.

Pricing could also improve, it's a bit expensive.

I have been working with Microsoft Sentinel for approximately two years.

There are private tenants, but it is deployed in a public Cloud.

Microsoft Sentinel is a stable solution.

Microsoft Sentinel is scalable. As it is in the cloud, you simply pay more. It's expensive, but it's very easy to scale.

We haven't used Microsoft's technical support. We rely on the online knowledge base. Essentially, the entire internet is based on the information they have. As a result, we have never contacted technical support. It hasn't been required. I suppose it's fine. We didn't use technical support in that sense. I would say that it's good.

I am familiar with SIEM. 

We run several CM systems as well as a security operation center.

I have worked with Microsoft, IBM, and McAfee. McAfee has an older CM, and we use Elastic as well.

Within the same cloud environment, it is very simple to set up and begin collecting data.

Microsoft Sentinel is expensive.

If you have the funds, I would recommend it. I think the pricing is important; it's quite expensive, but if you have that, I think I would recommend it. The advice is to think carefully about what data you send to the platform because it is costly. The price is data-driven, so make sure you know how much data you will send and that you only send what is required. That, I believe, is the key point.

We are Microsoft partners.

I would rate Microsoft Sentinel a seven out of ten.