Microsoft Sentinel
Microsoft Sentinel is Microsoft's cloud-native SIEM with SOAR, UEBA and threat intelligence, run from the Microsoft Defender portal; the Azure portal version retires in March 2027. A data lake tier keeps long-term security data at lower cost, queryable with KQL. An MCP server, generally available since November 2025, lets custom and third-party AI agents query Sentinel data and graphs.
- Main category
- SIEM
- Additional capabilities
- AI SOC Capability, Data Analytics / UABA, Data Pipeline, Automation, CIRM / Case Management
- Deployment type
- Build it Yourself
- Headquarters
- United States
- Founded
- 1975
- Funding
- Corporate
- SecOps Shift Map coverage
- Data, Detection Engineering, Triage and Investigation, Response
- Website
- https://www.microsoft.com/en-us/security/business/siem-and-xdr/microsoft-sentinel
Alternatives to Microsoft Sentinel
Other published vendors in the same primary category. Listed alphabetically, not ranked or endorsed. Confirm capabilities and fit against your own requirements.
Primary category: SIEM.
Explore the vendor directory or evaluate your shortlist with ASEF.
Profile last updated 2026-10-03.