Which works better with other applications and platforms?

Sentinel:

Sentinel plays well with anything inside the Azure stack. Microsoft includes a SOAR as part of the solution and provides playbooks to automate tasks and responses to alerts and detections. Azure Logic Apps’ managed connectors are used to link Sentinel to other components or services. Sentinel also provides pre-built playbooks, including more than 200+ connectors so you can build your own actions.

However, automating tasks for anything outside of Azure — such as Amazon Web Services (AWS) or Google Cloud Platform (GCP) — will be much more difficult and require a great deal of effort and coding. For customers who are 100% Azure, Sentinel has a great deal of flexibility, but for customers who have a multi-cloud environment, it may not be the best fit.

Splunk:

Splunk ingests data from just about any on-premises or cloud data source. But Splunk wants you to use everything in its ecosystem. For example, Splunk has its own SOAR (a really good one it acquired from Phantom) and encourages end users to use it. It can be difficult for users of Splunk Enterprise Security to integrate with a different SOAR platform.

Do Sentinel and Splunk have an integrated threat intelligence platform and other enrichments?

Sentinel:

Sentinel does not have an integrated, out-of-the-box TIP. But it does support several connectors with threat intelligence feeds. These must be manually configured in your Sentinel environment. You’ll find documentation on how to manually set up data from TIPs in Sentinel’s documentation: https://docs.microsoft.com/en-us/azure/sentinel/connect-threat-intelligence

Splunk:

Splunk does not offer threat intelligence enrichments out of the box. It does offer the ability to integrate with a TIP, but that integration must be set up manually. The integration process is described in Splunk’s documentation under the section “Threat Intelligence Framework.”

Do Sentinel and Splunk make your SOC analysts more effective?

Sentinel:

If you are a 100% Azure cloud organization, or a combination of mostly Microsoft on-premises technology and Azure, then Sentinel could be a very attractive solution. The ease of getting data into Sentinel from Microsoft data sources — such as Microsoft 365 Defender or Defender for Endpoint — gives Sentinel a quick time to value curve for organizations with an entirely Microsoft ecosystem. The Logic Apps offer a way to automate tasks and responses within your Azure environment without an incredible amount of coding. 

The weakest link in the Sentinel story is arguably the underlying Microsoft SQL database service, which doesn’t have a great reputation for being the most performant and scalable database. This could lead to long query times, and thus long investigation times, as data ingestion scales up.

For customers who have a broad mix of Microsoft and non-Microsoft technologies, Sentinel could be more trouble than it’s worth. Onboarding custom application logs will be especially difficult. And automating tasks and responses in other cloud providers, such as AWS and GCP, will be equally troublesome.

Splunk:

For an experienced Splunk ninja, it could improve analyst performance. But most SOC analysts are not also Splunk experts. It takes a lot of time and training to become proficient with the Splunk platform. Since Splunk uses a proprietary query language (SPL), it is not easy for general security analysts to use. Many SOC analysts struggle with Splunk Enterprise Security.

If you have a team of dedicated Splunk experts who can perform the configuration, set up the dashboards, and build the queries for your SOC analysts, then you might obtain a lot of value from using it. However, if your security team is on its own to do all the setup, configuration, dashboard and query building, it may be difficult to realize value from such an expensive platform.

Azure Sentinel Price:

While Sentinel’s license includes all features, it does have some pricing pitfalls you need to consider. The biggest charge to watch for is the additional cost associated with exceeding your reserve pricing. Since Sentinel pricing is reserve-based, exceeding your reserve puts you into an “on-demand” pricing structure, which can escalate quickly if you significantly exceed your reserve. This model presents a challenge for customers with bursty data needs — either you over-provision for the majority of the time, or you pay occasional penalties for exceeding your reserve. It’s challenging for Sentinel users to plan an annual budget for SOC costs.

Splunk Price:

The Splunk price model is very complex. The company charges you for extra storage, they charge extra for encrypting your data at rest, and the SIEM itself is an additional cost on top of their core product (which you must buy). Of the vendors evaluated here, Splunk is the worst when it comes to surprising customers with additional costs.

Of these vendors, Splunk is the least attractive choice. Although it has a rich feature set, it is essentially a legacy SIEM. And its pricing model is complicated and expensive.

Microsoft Sentinel is a true next-gen SIEM, but it is most suitable for organizations that have predominantly Microsoft technology stacks. This bias makes it a solid niche player, but it will not work for many of today’s large, multi-cloud enterprises.

Devo is not only a true next-gen SIEM, but it offers the flexibility required by large enterprise accounts with multiple technology stacks across multiple cloud providers. Devo’s ability to ingest data raw — with no indexing — makes it an ideal solution for customers with rapidly changing technologies. And its ability to scale out to terabytes of ingestion a day while offering 400 days of always-hot searchable storage makes it an ideal fit for very large organizations with long-term data needs. Finally, Devo’s simple, all-inclusive pricing model makes understanding and predicting costs easy — now and in the future.

To learn more about how Devo stacks up against Splunk and Sentinel, download the Buyer’s Guide for Next-Gen SIEM.