Security analytics & SIEM · Microsoft Corporation

Microsoft Sentinel

Cloud-native SIEM and SOAR built on Azure Log Analytics, billed per GB ingested per day with optional commitment discounts.

Visit Microsoft Sentinel Alternatives

Microsoft Sentinel is a cloud-native SIEM and SOAR platform built on the Azure Monitor Log Analytics workspace, giving it elastic scale without customers managing indexing infrastructure themselves. It correlates signals across Microsoft 365, Entra ID, Defender products and third-party sources via a large connector catalog, and layers in AI-assisted investigation (Copilot for Security) and automated playbooks. It splits ingestion into an Analytics tier (full query/alerting, billed per GB/day with optional commitment tiers up to 50,000GB/day for discounts) and a cheaper Data Lake tier for high-volume logs kept for retrospective search rather than real-time alerting. Microsoft does not publish flat dollar rates on its pricing page — actual per-GB cost depends on region and is obtained via the Azure pricing calculator or a quote.

At a glance

Vendor Microsoft Corporation
Pricing model Usage-based
Free tier No
Deployment Cloud
Open source No
Best for Organizations already on Azure/Microsoft 365 wanting a natively integrated, elastically scaled SIEM.

Pricing

Analytics tier bills per GB ingested/day (pay-as-you-go or discounted commitment tiers up to 52% off); a separate Data Lake tier bills per GB for low-cost long-term storage. No flat dollar figures are published; use Microsoft's calculator for a region-specific rate.

Checked on the vendor's own page on September 21, 2026: no prices are published. Expect to be quoted.

Features

  • Analytics and Data Lake ingestion tiers for cost-tiered retention
  • Prebuilt connectors for Microsoft 365, Entra ID, Defender and third-party sources
  • AI-assisted investigation via Copilot for Security
  • Automated response playbooks (SOAR)
  • User and entity behavior analytics (UEBA)
  • Commitment-tier discounts up to 50,000GB/day

Integrations

Profile last reviewed September 21, 2026

Head to head

Alternatives

IBM QRadar Long-established enterprise SIEM offering log correlation, UEBA and SOAR, now offered as SaaS or on-premises appliances. Exabeam SIEM/security analytics platform built around behavioral baselining (UEBA) to surface anomalous user and entity activity. Google Security Operations Google Cloud's SIEM, built on the Chronicle backend, offering high-volume, long-retention log search with integrated threat intelligence. Wazuh Free, open-source security platform combining SIEM and XDR capabilities for log analysis, threat detection and compliance.

Microsoft Sentinel in the index now

Terms to know

Anomaly detection Identifying data points or patterns that deviate significantly from expected or normal behavior. Data governance The policies, roles and processes that determine how data is defined, owned, accessed and kept compliant. Data lake A storage repository that holds raw data of any format cheaply, with structure applied only when the data is read. SIEM (security information and event management) A platform that centralizes and correlates log and event data across an IT environment to detect and investigate security threats. SOAR (security orchestration, automation and response) A platform that automates and orchestrates the response steps a security team takes after an alert is raised. User and entity behavior analytics (UEBA) Analytics that baseline normal user and device behavior and flag deviations that could signal a compromise, even without a known IOC.

Related guides

How to choose a SIEM Choose a SIEM by deployment model, whether detection is rule-based, behavioral, or code, and how the storage architecture handles cost as retention grows. Security analytics, explained How security teams turn logs and network noise into detected threats — SIEM, threat intelligence, and the metrics that measure a SOC's speed.