AWS Security Hub vs Microsoft Sentinel comparison

Cancel
You must select at least 2 products to compare!
Comparison Buyer's Guide
Executive Summary
Updated on Jun 27, 2023

We compared AWS Security Hub and Microsoft Sentinel based on our users’ reviews in four categories. After reading the collected data, you can find our conclusion below.

  • Ease of Deployment: AWS Security Hub's initial setup is straightforward, while Microsoft Sentinel's can be more involved. Security Hub is automatically enabled on AWS, but some configuration is still required. In contrast, Sentinel's onboarding and use case development may require ongoing attention. Integrating with on-prem resources can also be difficult for Sentinel.

  • Features: AWS Security Hub is highly appreciated for its integration capabilities and real-time alert capabilities, while Microsoft Sentinel is praised for its MSSP support, automation through Azure Logic Apps, and centralized management of security tools.

  • What Needs Improvement: AWS Security Hub needs more integration options and improvements to the user interface. Microsoft Sentinel needs to streamline CI/CD, on-prem log ingestion, and provide more connectors. Some users note information overload and documentation issues with Azure Sentinel, but it is constantly improving.

  • Pricing: AWS Security Hub has a reasonable and satisfactory setup cost, while Microsoft Sentinel's pricing and licensing can be confusing and vary depending on ingestion and retention charges. Sentinel offers different pricing tiers and licensing options, but it's important to monitor data usage to avoid unexpected charges. The cost of Sentinel ultimately depends on the number of logs and the type of subscription.

  • Service and Support: AWS Security Hub has efficient and effective technical support, while Microsoft Sentinel's support quality is inconsistent and dependent on the support plan. Technical support response times for both are not always quick, but AWS Security Hub's staff's expertise receives positive feedback.

Comparison Results: AWS Security Hub is viewed favorably for its performance, while Microsoft Sentinel has received mixed feedback. The latter offers advanced analysis and automation capabilities, but there have been instances of elevated expenses for certain users.

To learn more, read our detailed AWS Security Hub vs. Microsoft Sentinel Report (Updated: March 2024).
765,386 professionals have used our research since 2012.
Q&A Highlights
Question: Which is better - Azure Sentinel or AWS Security Hub?
Answer: We like that Azure Sentinel does not require as much maintenance as legacy SIEMs that are on-premises. Azure Sentinel is auto-scaling - you will not have to worry about performance impact, you will always have the performance capability you need. If you have Microsoft 365, it is very easy to plug the endpoints into Azure Sentinel. With this solution, you can go on the offensive and stay proactive, continually hunting for threats. Azure Sentinel is purely cloud-based and a leading next-generation SIEM. We have experienced a few false positives with Azure Sentinel. There is a certain level of expertise that you need to possess to appropriately utilize all of Azure Sentinel's offerings - it can be a somewhat steep learning curve to get things running at capacity. It would be an improvement if Azure Sentinel integrated better with other SaaS providers and offered more out-of-the-box connectors. You get a huge range of powerful security tools with AWS Security Hub, including compliance scanners, vulnerability endpoint protection, and firewalls. AWS Security Hub has very good detection and offers helpful real-time alerts. AWS Security Hub aggregates, organizes, and prioritizes security alerts or findings from other AWS services, all in one single pane. AWS Security Hub lacks a certain level of self-sufficiency, though. We would like to see AWS Security Hub become a multi-cloud solution. AWS Security Hub has some regional restrictions that have proved problematic for us; we need visibility for all instances we have on our account. We found that AWS Security Hub is not a good global product. Conclusion: We felt AWS was lacking in some basic features we consider essential, like multi-region coverage. We also wanted a solution that was more intuitive. We found Azure Sentinel to be a better fit for our team and our clients. We have a global reach and need a product that could satisfy cross-region coverage efficiently. We also feel that Azure Sentinel offers better proactive threat awareness.
Featured Review
Quotes From Members
We asked business professionals to review the solutions they use.
Here are some excerpts of what they said:
Pros
"Finding out if your infrastructure is secure is a valuable feature.""The best feature of AWS Security Hub is that you can get compliance or your cloud's current security posture.""I really like the seamless integration with the AWS account structure. It can even be made mandatory as part of the landing zone. These are great features. And there's a single pane of glass for the entire account.""I find all of the features to be highly valuable.""The most valuable feature of AWS Security Hub is the ability to track when monitoring is not enabled on any of my resources.""Cloudposse is a valuable feature as it guarantees my security.""I like that AWS Security Hub currently has several good features, around four or five. The technical support for AWS Security Hub is also responsive.""It's a security posture management tool from AWS. Basically, it identifies misconfigurations, similar to Trusted Advisor but on a larger scale."

More AWS Security Hub Pros →

"The initial setup is very simple and straightforward.""The features that stand out are the detection engine and its integration with multiple data sources.""The most valuable feature is the alert notifications, which are categorized by severity levels: informational, low, medium, and high.""The SOAR playbooks are Sentinel's most valuable feature. It gives you a unified toolset for detecting, investigating, and responding to incidents. That's what clearly differentiates Sentinels from its competitors. It's cloud-native, offering end-to-end coverage with more than 120 connectors. All types of data logs can be poured into the system so analysis can happen. That end-to-end visibility gives it the advantage.""It has basic out-of-the-box integrations with multiple log sources.""The AI capability is one of the main features of the solution because I believe that in the market, there are few solutions that are providing security solutions based on AI and machine learning.""Sentinel improved how we investigate incidents. We can create watchlists and update them to align with the latest threat intelligence. The information Microsoft provides enables us to understand thoroughly and improve as we go along. It allows us to provide monthly reports to our clients on their security posture.""There are a lot of things you can explore as a user. You can even go and actively hunt for threats. You can go on the offensive rather than on the defensive."

More Microsoft Sentinel Pros →

Cons
"From an improvement perspective, there is a need to add more compliance since, right now, AWS Security Hub only provides four to five compliances to control the tool.""It is not flexible for multi-cloud environments.""Security needs to be measured based on their own criteria. We can't add custom criteria specific to our organization. For example, having an S3 bucket publicly available might be flagged as a critical alert, but it might not be critical in a sandbox environment. So, it gets flagged as critical, which becomes a false positive. So, customization options and creating custom dashboards would be areas for improvement.""One aspect that could be improved in the solution is its adaptability to different markets and geopolitical restrictions. In certain regions like Thailand, specific services from certain countries or providers, such as AWS or Azure, might be limited or blocked. It also needs improvement in would require configuring the solution more adaptable to AWS infrastructure and function.""AWS Security Hub should improve the time it takes to update. It takes a long period of time when updating. It can take 24 hours sometimes to update. Additionally, when integrating this solution with more security tools, takes time.""Adding SIEM features would be beneficial because of the limited customization of AWS Security Hub.""The telemetry doesn't always go into the control center. When you have multiple instances running in AWS, you need a control tower to take feeds from Security Hub and analyze your results. Sometimes exemptions aren't passed between the control tower and Security Hub. The configuration gets mixed up or you don't get the desired results.""It's not user-friendly. Too much going on, too many unnecessary findings, not very visual. You can't do much compared to other similar tools that are cheaper and better."

More AWS Security Hub Cons →

"We do have in-built or out-of-the-box metrics that are shown on the dashboard, but it doesn't give the kind of metrics that we need from our environment whereby we need to check the meantime to detect and meantime to resolve an incident. I have to do it manually. I have to pull all the logs or all the alerts that are fed into Sentinel over a certain period. We do this on a monthly basis, so I go into Microsoft Sentinel and pull all the alerts or incidents we closed over a period of thirty days.""Everyone has their favorites. There is always room for improvement, and everybody will say, "I wish you could do this for me or that for me." It is a personal thing based on how you use the tool. I do not necessarily have those thoughts, and they are probably not really valuable because they are unique to the context of the user, but broadly, where it can continue to improve is by adding more connectors to more systems.""Sentinel could improve its ticketing and management. A few customers I have worked with liked to take the data created in Sentinel. You can make some basic efforts around that, but the customers wanted to push it to a third-party system so they could set up a proper ticketing management system, like ServiceNow, Jira, etc.""Multi-tenancy, in my opinion, needs to be improved. I believe it can do better as a managed service provider.""Only one thing is missing: NDR is not available out-of-the-box. The competitive cloud-native SIEM providers have the NDR component. Currently, Sentinel needs NDR to be powered from either Corelight or some other NDR provider.""Add more out-of-the-box connectors with other SaaS platforms/applications.""Sometimes, we are observing large ingestion delays. We expect logs within 5 minutes, but it takes about 10 to 15 minutes.""If Sentinel had a graphical user interface, it would be easier to use. I would also like it to be more customizable."

More Microsoft Sentinel Cons →

Pricing and Cost Advice
  • "The price of the solution is not very competitive but it is reasonable."
  • "The price of AWS Security Hub is average compared to other solutions."
  • "The pricing is fine. It is not an expensive tool."
  • "AWS Security Hub's pricing is pretty reasonable."
  • "There are multiple subscription models, like yearly, monthly, and packaged."
  • "AWS Security Hub is not an expensive tool. I would consider it to be a cheap solution. AWS Security Hub follows the PAYG pricing model, meaning you will have to pay for whatever you use."
  • "Security Hub is not an expensive solution."
  • More AWS Security Hub Pricing and Cost Advice →

  • "It comes with a Microsoft subscription which the customer has, so they don't have to invest somewhere else."
  • "It is a consumption-based license model. bands at 100, 200, 400 GB per day etc. Azure Sentinel Pricing | Microsoft Azure"
  • "Good monthly operational cost model for the detection and response outcomes delivered, M365 logs don't count toward the limits which is a good benefit."
  • "I have had mixed feedback. At one point, I heard a client say that it sometimes seems more expensive. Most of the clients are on Office 365 or M365, and they are forced to take Azure SIEM because of the integration."
  • "It is kind of like a sliding scale. There are different tiers of pricing that go from $100 per day up to $3,500 per day. So, it just kind of depends on how much data is being stored. There can be additional costs to the standard license other than the additional data. It just kind of depends on what other services you're spinning up in Azure, or if you're using something like Azure log analytics."
  • "I am just paying for the log space with Azure Sentinel. It costs us about $2,000 a month. Most of the logs are free. We are only paying money for Azure Firewall logs because email logs or Azure AD logs are free to use for us."
  • "Sentinel is a bit expensive. If you can figure a way of configuring it to meet your needs, then you can find a way around the cost."
  • "Azure Sentinel is very costly, or at least it appears to be very costly. The costs vary based on your ingestion and your retention charges."
  • More Microsoft Sentinel Pricing and Cost Advice →

    report
    Use our free recommendation engine to learn which Security Information and Event Management (SIEM) solutions are best for your needs.
    765,386 professionals have used our research since 2012.
    Answers from the Community
    Netanya Carmi
    Shibu Babuchandran - PeerSpot reviewerShibu Babuchandran
    Real User

    Hi @Netanya Carmi ​,


    Had prepared some comparison factors between AWS and Azure for one of my presales discussions, hope this will hold some insights .So depending on the requirements from the client appropriate solutions can be proposed. Widely Azure Sentinel is what has be going of matching the customer requriements.














































































































































































































































































































































































    AI and machine learning
    AWS service Azure service Description
    SageMaker Machine Learning A cloud service to train, deploy, automate, and manage machine learning models.
    Alexa Skills Kit Bot Framework Build and connect intelligent bots that interact with your users using text/SMS, Skype, Teams, Slack, Microsoft 365 mail, Twitter, and other popular services.
    Lex Speech Services API capable of converting speech to text, understanding intent, and converting text back to speech for natural responsiveness.
    Lex Language Understanding (LUIS) Allows your applications to understand user commands contextually.
    Polly, Transcribe Speech Services Enables both Speech to Text, and Text into Speech capabilities.
    Rekognition Cognitive Services Computer Vision: Extract information from images to categorize and process visual data.
    Face: Detect, identify, and analyze faces and facial expressions in photos.
    Skills Kit Virtual Assistant The Virtual Assistant Template brings together a number of best practices we've identified through the building of conversational experiences and automates integration of components that we've found to be highly beneficial to Bot Framework developers.
    Big data and analytics
    AWS service Azure service Description
    Redshift Synapse Analytics Cloud-based Enterprise Data Warehouse (EDW) that uses Massively Parallel Processing (MPP) to quickly run complex queries across petabytes of data.
    Lake Formation Data Share A simple and safe service for sharing big data
    Big data processing
    AWS service Azure service Description
    EMR Azure Data Explorer Fully managed, low latency, distributed big data analytics platform to run complex queries across petabytes of data.
    EMR Databricks Apache Spark-based analytics platform.
    EMR HDInsight Managed Hadoop service. Deploy and manage Hadoop clusters in Azure.
    EMR Data Lake Storage Massively scalable, secure data lake functionality built on Azure Blob Storage.
    Data orchestration / ETL
    AWS service Azure service Description
    Data Pipeline, Glue Data Factory Processes and moves data between different compute and storage services, as well as on-premises data sources at specified intervals. Create, schedule, orchestrate, and manage data pipelines.
    Glue Azure Purview A unified data governance service that helps you manage and govern your on-premises, multicloud, and software as a service (SaaS) data.
    Dynamo DB Table Storage, Cosmos DB NoSQL key-value store for rapid development using massive semi-structured datasets.

    Analytics and visualization
    AWS service Azure service Description
    Kinesis Analytics Stream Analytics Storage and analysis platforms that create insights from large quantities of data, or data that originates from many sources.
    Azure Data Explorer
    Data Lake Analytics
    Data Lake Store
    QuickSight Power BI Business intelligence tools that build visualizations, perform ad hoc analysis, and develop business insights from data.
    CloudSearch Cognitive Search Delivers full-text search and related search analytics and capabilities.
    Athena Data Lake Analytics Provides a serverless interactive query service that uses standard SQL for analyzing databases.
    Azure Synapse Analytics Azure Synapse Analytics is a limitless analytics service that brings together data integration, enterprise data warehousing, and big data analytics. It gives you the freedom to query data on your terms, using either serverless or dedicated resources at scale.
    Elasticsearch Service Elastic on Azure Use the Elastic Stack (Elastic, Logstash, and Kibana) to search, analyze, and visualize in real time.
    Database
    Type AWS Service Azure Service Description
    Relational database RDS SQL Database Managed relational database services in which resiliency, scale and maintenance are primarily handled by the Azure platform.
    Database for MySQL
    Database for PostgreSQL
    Database for MariaDB
    Serverless relational database Amazon Aurora Serverless Azure SQL Database serverless Database offerings that automatically scales compute based on the workload demand. You're billed per second for the actual compute used (Azure SQL)/data that's processed by your queries (Azure Synapse Analytics Serverless).
    Serverless SQL pool in Azure Synapse Analytics
    NoSQL/ DynamoDB Cosmos DB Cosmos DB is a globally distributed, multi-model database that natively supports multiple data models including key-value pairs, documents, graphs and columnar.
    Document
    SimpleDB
    Amazon DocumentDB
    Caching ElastiCache Cache for Redis An in-memory–based, distributed caching service that provides a high-performance store typically used to offload nontransactional work from a database.
    Database migration Database Migration Service Database Migration Service A service that executes the migration of database schema and data from one database format to a specific database technology in the cloud.

    Questions from the Community
    Top Answer:We like that Azure Sentinel does not require as much maintenance as legacy SIEMs that are on-premises. Azure Sentinel is auto-scaling - you will not have to worry about performance impact, you will… more »
    Top Answer:I really like the seamless integration with the AWS account structure. It can even be made mandatory as part of the landing zone. These are great features And there's a single pane of glass for the… more »
    Top Answer:There is room for improvement in a couple of things. One is that the dashboard isn't very customizable. Another is that the alerting level is the same across the entire account. Every organization has… more »
    Top Answer:Yes, Azure Sentinel is a SIEM on the Cloud. Multiple data sources can be uploaded and analyzed with Azure Sentinel and its Threat Hunting functionality with AI available as templates or customized by… more »
    Top Answer:It would really depend on (1) which logs you need to ingest and (2) what are your use cases Splunk is easy for ingestion of anything, but the charge per GB/Day Indexed and it gets expensive as log… more »
    Top Answer:The most valuable feature is the alert notifications, which are categorized by severity levels: informational, low, medium, and high.
    Ranking
    Views
    8,658
    Comparisons
    7,156
    Reviews
    11
    Average Words per Review
    425
    Rating
    7.4
    Views
    33,792
    Comparisons
    18,846
    Reviews
    60
    Average Words per Review
    1,620
    Rating
    8.4
    Comparisons
    Also Known As
    Azure Sentinel
    Learn More
    Overview

    AWS Security Hub is a comprehensive security service that provides a centralized view of security alerts and compliance status across an AWS environment. It collects data from various AWS services, partner solutions, and AWS Marketplace products to provide a holistic view of security posture. With Security Hub, users can quickly identify and prioritize security issues, automate compliance checks, and streamline remediation efforts. 

    The service offers a range of features including continuous monitoring, threat intelligence integration, and customizable dashboards. It also provides automated insights and recommendations to help users improve their security posture. Security Hub integrates with other AWS services like Amazon GuardDuty, AWS Config, and AWS Macie to provide a unified security experience. Additionally, it supports integration with third-party security tools through its API, allowing users to leverage their existing security investments. 

    With its user-friendly interface and powerful capabilities, AWS Security Hub is a valuable tool for organizations looking to enhance their security and compliance posture in the cloud.

    Microsoft Sentinel is a scalable, cloud-native, security information event management (SIEM) and security orchestration automated response (SOAR) solution that lets you see and stop threats before they cause harm. Microsoft Sentinel delivers intelligent security analytics and threat intelligence across the enterprise, providing a single solution for alert detection, threat visibility, proactive hunting, and threat response. Eliminate security infrastructure setup and maintenance, and elastically scale to meet your security needs—while reducing IT costs. With Microsoft Sentinel, you can:

    - Collect data at cloud scale—across all users, devices, applications, and infrastructure, both on-premises and in multiple clouds

    - Detect previously uncovered threats and minimize false positives using analytics and unparalleled threat intelligence from Microsoft

    - Investigate threats with AI and hunt suspicious activities at scale, tapping into decades of cybersecurity work at Microsoft

    - Respond to incidents rapidly with built-in orchestration and automation of common tasks

    To learn more about our solution, ask questions, and share feedback, join our Microsoft Security, Compliance and Identity Community.

    Sample Customers
    Edmunds, Frame.io, GoDaddy, Realtor.com
    Microsoft Sentinel is trusted by companies of all sizes including ABM, ASOS, Uniper, First West Credit Union, Avanade, and more.
    Top Industries
    REVIEWERS
    Computer Software Company17%
    Financial Services Firm17%
    Recruiting/Hr Firm8%
    Non Profit8%
    VISITORS READING REVIEWS
    Computer Software Company17%
    Financial Services Firm12%
    Manufacturing Company8%
    Government7%
    REVIEWERS
    Financial Services Firm22%
    Computer Software Company11%
    Manufacturing Company8%
    Comms Service Provider8%
    VISITORS READING REVIEWS
    Computer Software Company16%
    Financial Services Firm10%
    Government9%
    Manufacturing Company7%
    Company Size
    REVIEWERS
    Small Business40%
    Midsize Enterprise13%
    Large Enterprise47%
    VISITORS READING REVIEWS
    Small Business22%
    Midsize Enterprise13%
    Large Enterprise65%
    REVIEWERS
    Small Business33%
    Midsize Enterprise21%
    Large Enterprise47%
    VISITORS READING REVIEWS
    Small Business25%
    Midsize Enterprise16%
    Large Enterprise59%
    Buyer's Guide
    AWS Security Hub vs. Microsoft Sentinel
    March 2024
    Find out what your peers are saying about AWS Security Hub vs. Microsoft Sentinel and other solutions. Updated: March 2024.
    765,386 professionals have used our research since 2012.

    AWS Security Hub is ranked 8th in Security Information and Event Management (SIEM) with 14 reviews while Microsoft Sentinel is ranked 1st in Security Information and Event Management (SIEM) with 85 reviews. AWS Security Hub is rated 7.4, while Microsoft Sentinel is rated 8.2. The top reviewer of AWS Security Hub writes "A centralized dashboard that enables efficient monitoring and management of possible security issues". On the other hand, the top reviewer of Microsoft Sentinel writes "Gives a comprehensive and holistic view of the ecosystem and improves visibility and the ability to respond". AWS Security Hub is most compared with Prisma Cloud by Palo Alto Networks, Wiz, Microsoft Defender for Cloud, Splunk Enterprise Security and Oracle Security Monitoring and Analytics Cloud Service, whereas Microsoft Sentinel is most compared with IBM Security QRadar, Microsoft Defender for Cloud, Splunk Enterprise Security, Elastic Security and Wazuh. See our AWS Security Hub vs. Microsoft Sentinel report.

    See our list of best Security Information and Event Management (SIEM) vendors and best Security Orchestration Automation and Response (SOAR) vendors.

    We monitor all Security Information and Event Management (SIEM) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.