Try our new research platform with insights from 80,000+ expert users

Coralogix vs Microsoft Sentinel comparison

 

Comparison Buyer's Guide

Executive SummaryUpdated on Sep 18, 2024

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Coralogix
Ranking in Security Information and Event Management (SIEM)
20th
Average Rating
8.4
Reviews Sentiment
6.6
Number of Reviews
14
Ranking in other categories
Application Performance Monitoring (APM) and Observability (21st), Log Management (20th), API Management (14th), Streaming Analytics (15th), Anomaly Detection Tools (2nd), AI Observability (14th)
Microsoft Sentinel
Ranking in Security Information and Event Management (SIEM)
4th
Average Rating
8.2
Reviews Sentiment
6.9
Number of Reviews
107
Ranking in other categories
Security Orchestration Automation and Response (SOAR) (1st), Microsoft Security Suite (6th), AI-Powered Cybersecurity Platforms (5th)
 

Mindshare comparison

As of March 2026, in the Security Information and Event Management (SIEM) category, the mindshare of Coralogix is 1.0%, up from 0.3% compared to the previous year. The mindshare of Microsoft Sentinel is 4.6%, down from 7.5% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Security Information and Event Management (SIEM) Mindshare Distribution
ProductMindshare (%)
Microsoft Sentinel4.6%
Coralogix1.0%
Other94.4%
Security Information and Event Management (SIEM)
 

Featured Reviews

Naveenkumar Lakshman - PeerSpot reviewer
Presales Engineer at Crayon AS
Centralized monitoring has improved real-time issue tracking and reduced root cause analysis time
One of the best features that Coralogix offers is that it is integration friendly. I can seamlessly work with different cloud providers including AWS, Azure, and GCP. I can monitor Kubernetes or Docker platforms as well, and I can integrate with the DevOps chain including Jenkins and all infrastructure code, Terraform, or Ansible. Coralogix has positively impacted my organization by providing a centralized console to monitor the dashboard, giving me rich flexibility to see different sorts of data that is spread across the logs, metrics, or traces, which are the typical pillars of the observability tool. I have the interface where I can use the drag-and-drop feature, and I can create different types of charts. Mainly, I have the line charts and time series ones that I generally use in many use cases, gauges, tables, pie charts, or markdown widgets. These are the ones generically available, and I can switch between the visualization types. I am getting the underlying query in that and can import and export dashboards built upon the JSON format. I can have my own APIs integrated with my dashboards as well, such as with Terraform, which is useful for scaling across my environments. Regarding root cause analysis, mainly what I can do is correlate across all of the layers because the main logs that I work on are storage-related, including CIFS, NFS, SAN traffic, and the metrics including storage, throughput, or VM resource usage. Being able to view logs, metrics, or traces available, I get all of these in one place, and I can do root cause analysis much quicker.
Kallamuddin Ansari - PeerSpot reviewer
Cyber Security Consultant at ProTechmanize
Centralized monitoring has improved threat response but cost control still needs refinement
Based on real operations used in our corporate IT environment, the key features include log correlation and incident view. Microsoft Sentinel's biggest strength is how it correlates multiple related alerts into a single incident. This significantly reduces alert noise and helps the SOC focus on real threats instead of isolated events. Another valuable feature is KQL-based threat hunting with Kusto Query Language. The flexibility of this language allows us to build custom hunting queries based on our environment's behavior. This is extremely useful for detecting low and slow threats or hidden threats that default rules may miss. Cloud-native scalability and stability is another important feature. Being cloud-native, Microsoft Sentinel scales well for medium to large corporate environments without infrastructure management. Stability has been solid in day-to-day production. SOAR automation using playbooks is a feature we highly recommend. Microsoft Sentinel's SOAR functionality helps automate repetitive SOC tasks like alert enrichment and notification. This saves analyst time and improves response consistency.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"After implementing Coralogix, I noticed specific outcomes and improvements; whenever we try to fetch the data or check the monitoring logs, the spikes, the bars, and the graphs open very quickly, the latency is really very low, and it opens everything very fast, which makes a good impact on our organization."
"The most valuable feature of Coralogix is that it is a very good vendor for metrics."
"For now, we have not experienced any stability issues."
"Coralogix saves us the need to actively tune and dig deep into our logs, which is something we have to do with other log management solutions, and is a genuine time saver due to its smart capabilities."
"Coralogix has positively impacted my organization by providing a centralized console to monitor the dashboard, giving me rich flexibility to see different sorts of data that is spread across the logs, metrics, or traces, which are the typical pillars of the observability tool."
"Coralogix scales well, and I will rate it nine out of ten."
"A non-tech person can easily get used to it."
"The overall stability and reliability of Coralogix are excellent, and I rarely encounter issues."
"Free ingestion for Azure logs (with E5 licence)"
"The AI and ML of Azure Sentinel are valuable. We can use machine learning models at the tenant level and within Office 365 and Microsoft stack. We don't need to depend upon any other connectors. It automatically provisions the native Microsoft products."
"The UI of Sentinel is very good and easy to use, even for beginners."
"The best feature of Microsoft Sentinel is its ability to unify all dashboards or functions into one modern SecOps dashboard."
"Sentinel improved how we investigate incidents. We can create watchlists and update them to align with the latest threat intelligence. The information Microsoft provides enables us to understand thoroughly and improve as we go along. It allows us to provide monthly reports to our clients on their security posture."
"The most valuable feature is the onboarding of the workloads. You can see all that has been onboarded in your account on the dashboards."
"A lot of the automation inside Sentinel comes with inside actually rolling out brand new Sentinel environments. We utilize that a lot and it might go beyond just Sentinel, for example, utilizing templates in Azure and templates elsewhere to actually deploy out."
"You can fine-tune the SOAR and you'll be charged only when your playbooks are triggered. That is the beauty of the solution because the SOAR is the costliest component in the market today... but with Sentinel it is upside-down: the SOAR is the lowest-hanging fruit. It's the least costly and it delivers more value to the customer."
 

Cons

"The documentation of the tool could be improved"
"In terms of documentation, I think there can be more user-friendly documentation that stresses more on day-to-day issues."
"Coralogix should have some AI capabilities to auto-detect anomalies and provide suggestions. The increasing volume of data and the resulting bandwidth charges are concerns."
"Coralogix should have some AI capabilities to auto-detect anomalies and provide suggestions."
"The user interface could be more intuitive and explanatory."
"From my experience, Coralogix has horrible Terraform providers."
"As a relatively new product, there are some rough edges yet and your mileage may vary."
"Coralogix's dashboard and search capabilities do not help me in any particular way."
"We have been working with multiple customers, and every time we onboard a customer, we are missing an essential feature that surprisingly doesn't exist in Sentinel. We searched the forums and knowledge bases but couldn't find a solution. When you onboard new customers, you need to enable the data connectors. That part is easy, but you must create rules from scratch for every associated connector. You click "next," "next," "next," and it requires five clicks for each analytical rule. Imagine we have a customer with 150 rules."
"We do see continuous improvement all the time, however, I haven't got a specific feature that is lacking or not well designed."
"There is room for improvement in terms of integrations. We have some tools, such as our off-site Meraki firewalls, that have not fully integrated with Sentinel. We lack integration for Syslogs into Sentinel."
"Microsoft Sentinel should provide an alternative query language to KQL for users who lack KQL expertise."
"The learning curve could be improved. I am still learning it. We were able to implement the basic features to get them up and running, but there are still so many things that I don't know about all its features. They have a lot of features that we have not been able to use or apply. If they could work on reducing the solution's learning curve, that would be good. While there is a training course held by Microsoft to learn more about this solution, there is a cost associated with it."
"If their UI was a bit more streamlined and easy to find when I need it, then that would be a great improvement."
"There is some relatively advanced knowledge that you have to have to properly leverage Sentinel's full capabilities. I'm thinking about things like the creation of workbooks, how you do threat-hunting, and the kinds of notifications you're getting... It takes time for people to ramp up on that and develop a familiarity or expertise with it."
"The dashboards can be improved. Creating dashboards is very easy, but the visualizations are not as good as Microsoft Power BI. People who are using Microsoft Power BI do not like Sentinel's dashboards."
 

Pricing and Cost Advice

"The cost of the solution is per volume of data ingested."
"We are paying roughly $5,000 a month."
"Currently, we are at a very minimal cost, which is around $400 per month since we have reduced our usage. Initially, we were at $900 per month."
"The platform has a reasonable cost. I rate the pricing a three out of ten."
"It's costly to maintain and renew."
"The pay-as-you-go model is beneficial to customers."
"Microsoft Sentinel is expensive."
"We are charged based on the amount of data used, which can become expensive."
"From a cost perspective, there are some additional charges in addition to the licensing."
"I'm not happy with the pricing on the integration with Defender for Endpoint. Defender for Endpoint is log-rich. There is a lot of information coming through, and it is needed information. The price point at which you ingest those logs has made a lot of my customers make the decision to leave that within the Defender stack."
"Microsoft can enhance the licensing side. I feel there is confusion sometimes... They should have a single license in which we have the opportunity to use the EDR or CASB solution."
"Pricing for Microsoft Sentinel could always be lower, but it's workable. The ingestion costs for the data analytics is usually the highest cost, but the licensing per Microsoft Sentinel is fairly straightforward and transparent."
report
Use our free recommendation engine to learn which Security Information and Event Management (SIEM) solutions are best for your needs.
884,933 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Financial Services Firm
10%
Computer Software Company
10%
Manufacturing Company
8%
Comms Service Provider
7%
Computer Software Company
12%
Financial Services Firm
10%
Manufacturing Company
9%
Government
8%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
By reviewers
Company SizeCount
Small Business8
Midsize Enterprise2
Large Enterprise6
By reviewers
Company SizeCount
Small Business41
Midsize Enterprise22
Large Enterprise46
 

Questions from the Community

What do you like most about Coralogix?
Numerous data monitoring tools are available, but Coralogix somehow fine-tunes our policies and effectively supports our teams.
What is your experience regarding pricing and costs for Coralogix?
I am not aware of the pricing, setup cost, and licensing for Coralogix, as this comes under the business analyst, marketing team, and pre-sales team. I am from the technical line.
What needs improvement with Coralogix?
I think Coralogix can be improved by setting up some AI type of tool inside it which can help new users. Whenever they face any kind of issue or troubleshooting problem, I know that they already sh...
Is there a common threat intelligence tool that aggregates multiple threat intelligence sources?
Yes, Azure Sentinel is a SIEM on the Cloud. Multiple data sources can be uploaded and analyzed with Azure Sentinel and its Threat Hunting functionality with AI available as templates or customized ...
What is a better choice, Splunk or Azure Sentinel?
It would really depend on (1) which logs you need to ingest and (2) what are your use cases Splunk is easy for ingestion of anything, but the charge per GB/Day Indexed and it gets expensive as log ...
Which is better - Azure Sentinel or AWS Security Hub?
We like that Azure Sentinel does not require as much maintenance as legacy SIEMs that are on-premises. Azure Sentinel is auto-scaling - you will not have to worry about performance impact, you will...
 

Also Known As

No data available
Azure Sentinel
 

Overview

 

Sample Customers

Payoneer, AGS, Monday.com, Capgemini
Microsoft Sentinel is trusted by companies of all sizes including ABM, ASOS, Uniper, First West Credit Union, Avanade, and more.
Find out what your peers are saying about Coralogix vs. Microsoft Sentinel and other solutions. Updated: March 2026.
884,933 professionals have used our research since 2012.