Microsoft Sentinel

Microsoft Sentinel scores 7.81 of 10, first of the 12 profiled, in band A with Elastic Security. Its docs describe a repository connection that deploys KQL analytics rules from GitHub or Azure DevOps, health and audit tables for rule runs, and an ATT&CK coverage page. Testing and rule languages are thinner.

Rubric total

7.81 of 10, first of 14 scored, first of 12 profiled

Matrix score

12.5 of 33 (10 documented, 5 partial, 18 not documented)

Rule health

1 documented, 1 partial of 5 matrix rule-health columns

Ownership

Part of a larger company, Microsoft Corporation. Microsoft Sentinel is a Microsoft product. Azure portal support ends after 2027-03-31; from then it runs only in the Microsoft Defender portal. learn.microsoft.com read 2026-11-03

Website

microsoft.com

What Microsoft Sentinel is

Microsoft Sentinel is a cloud SIEM built on Azure Monitor Log Analytics workspaces (Microsoft pricing page, read 2026-11-03). Detections are called analytics rules and are written in KQL. Content deploys as Bicep or ARM templates, and the docs ship a PowerShell script that converts public YAML rules (Microsoft Learn, read 2026-11-04).

The detection-as-code feature is called Repositories. It connects a workspace to GitHub or Azure DevOps, creates the workflow, and uses smart deployments to push only the files that changed. Health lives in two log tables, SentinelHealth and SentinelAudit. Microsoft says Azure portal support ends after 2027-03-31 and that Sentinel then runs only in the Defender portal (vendor claim, Microsoft Learn, read 2026-11-03).

Vendor description: Microsoft Sentinel is a cloud SIEM built on Azure Monitor Log Analytics workspaces. It runs analytics rules, KQL hunting, automation rules that can call Azure Logic Apps playbooks, and a data lake tier for long-term security data. microsoft.com read 2026-11-03

How Microsoft Sentinel scores on the rubric

7.81 of 10 across eight weighted criteria. It sits in band A with Elastic Security: totals within 0.25 are a band, not a ladder. Each score has its reason and the page it was read from. The rubric explains the bands.

Microsoft Sentinel on the eight rubric criteria. Part = weight times score over 100; the parts sum to the total.

The 33 capabilities for Microsoft Sentinel

documentedpartialnot documented

Notes and sources for each cell are on the group pages: Languages, Source control and CI, Testing, Coverage analytics, Rule health, Library.

Where Microsoft Sentinel is strong

• Repositories connect a workspace to GitHub or Azure DevOps, generate the workflow and deploy only changed files through smart deployments. They cover analytics rules, automation and custom detection rules (preview), with an API. The limit is five connections per workspace. learn.microsoft.com read 2026-11-04
• SentinelHealth logs each rule run with its failure reason and SentinelAudit logs before and after values. A workbook and delay queries cover retries, auto-disabled rules and skipped windows. learn.microsoft.com read 2026-11-04
• The MITRE page shows a matrix of active rules, simulated coverage from rules that are available but not configured and, in the Defender portal, a ratio against recommended detections. The page is in preview and aligned to ATT&CK v18. learn.microsoft.com read 2026-11-04

Where Microsoft Sentinel is behind

• Testing is a manual rerun of an analytics rule. The repositories docs show no unit tests and no test step in the pipeline. learn.microsoft.com read 2026-11-04
• KQL is the only analytics language, and no Sigma conversion path was read in the docs. Content deploys as Bicep or ARM, so a team moving from another SIEM converts rules before it can use the pipeline. learn.microsoft.com read 2026-11-04
• The docs name no noisy-rule detection and no field drift alert. Health data is a log table you query, with no cost figure per rule. learn.microsoft.com read 2026-11-03

What only Microsoft Sentinel publishes

Sentinel's rule integrity doc says a scheduled rule gets six attempts per window, and a failure in one of those attempts flags a delay in the alert triggering. learn.microsoft.com read 2026-11-03

Pricing as published for Microsoft Sentinel

Analytics tier: pay-as-you-go per GB analysed, or commitment tiers that reserve daily ingestion (100 GB to 50,000 GB per day). Data lake tier: per GB ingested, processed, queried and stored, with separate compute meters. Playbooks add Azure Logic Apps charges. Prices are USD estimates on the pricing page, region selector present, values shown at the page's default region. microsoft.com read 2026-11-03

Published prices, read dates beside each.

Named customers of Microsoft Sentinel

No customers are named on the public pages read for Microsoft Sentinel.

Recent releases and news for Microsoft Sentinel

No dated releases were recorded for Microsoft Sentinel in the read.

Claims Microsoft Sentinel makes about itself

Each figure is the vendor's. The evidence grade is defined on the rubric page: A measured by a third party with the method published, B vendor-measured with sample and method, C vendor figure with no method, D figure with no source.

Vendor claims with the evidence grade and who measured.

Shortlist Microsoft Sentinel when

• Your logs already sit in a Log Analytics workspace and your analysts write KQL.
• You want rules reviewed in pull requests and deployed only when the file changed.
• You need a queryable record of which rules ran, failed or were auto-disabled, and who changed them.

Verdict on Microsoft Sentinel

First of 12 at 7.81, in band A with Elastic Security (7.60), so the two are not a strict order; the gap to Google SecOps (6.83) is real.

Compare Microsoft Sentinel

Alternatives to Microsoft Sentinel. Head-to-head diffs: SOC Prime, Anvilogic, Panther, Sigma and pySigma, Detecteam, Elastic Security, Splunk Enterprise Security (Cisco), Sekoia.io, Hunters, Google Security Operations, Mate Security.