SIEM Tools

Exabeam vs Microsoft Sentinel

Compare Exabeam and Microsoft Sentinel side-by-side. See feature differences and pricing in the SIEM Tools category.

by Exabeam

No reviews yet

Pricing: Quote only, after a demo. New-Scale Fusion, New-Scale SIEM and New-Scale Analytics run on Google Cloud. No trial.

Exabeam is a cloud SIEM and behavioral analytics platform for security operations teams, sold as New-Scale Fusion on Google Cloud by quote.

10 /18 features Full profile

Microsoft Sentinel

by Microsoft

No reviews yet

Pricing: Usage-based, USD, East US: analytics tier $4.30 per GB ingested pay-as-you-go, or commitment tiers from $296 a day for 100 GB; data lake tier from $0.05 per GB.

Microsoft Sentinel is Microsoft's cloud-native SIEM for SOC teams on Azure, with KQL hunting, UEBA and a security data lake, billed per gigabyte ingested.

14 /18 features Full profile

Feature Comparison

SIEM Tools features side-by-side

Feature	Exabeam 10/18 features	Microsoft Sentinel 14/18 features
Out-of-the-box log source connectors Prebuilt connectors ingest syslog, agent, cloud provider and SaaS logs without custom parsing.	Yes	Yes
Custom log parser builder Analysts define parsing for an unsupported source in the product rather than waiting for the vendor.	Yes	Yes
Normalisation to a common event schema Events from different sources are mapped to shared field names so one rule applies to all.	Yes	Yes
Prebuilt correlation rule library Vendor-maintained detection rules ship ready to enable and are updated as new threats emerge.	No	Yes
Sigma rule import Community Sigma detection rules can be imported or converted to the product's rule format.	Yes	No
User and entity behaviour analytics Baselines of user and host behaviour surface anomalies such as impossible travel or new peers.	Yes	Yes
Risk-based alerting on entity scores Low-fidelity signals accumulate a risk score per user or host that raises one alert at a threshold.	No	No
ATT&CK coverage map of active rules A heat map shows which MITRE ATT&CK techniques the enabled rules detect and where gaps are.	Yes	Yes
Threat intel indicator matching on ingest Ingested events are matched against threat intelligence indicators as they arrive.	No	Yes
Full-text and structured search language Analysts search raw logs with a query language that supports fields, joins and aggregation.	No	Yes
Tiered long-term log storage Older logs move to a cheaper cold or archive tier that remains searchable or can be rehydrated.	No	Yes
Federated search across external stores Queries run against data left in external stores or data lakes without ingesting it first.	Yes	Yes
Incident queue with analyst assignment Alerts become incidents that can be assigned, annotated and closed with a status workflow.	Yes	Yes
Native automation playbooks in the SIEM Automated response actions can be triggered from a rule without a separate SOAR product.	No	Yes
Compliance report packs for PCI and HIPAA Prebuilt reports map collected logs to PCI DSS, HIPAA or similar audit requirements.	Yes	Yes
Natural-language query assistant Analysts can ask questions in plain language and get a generated query or summary back.	Yes	No
Pricing published per GB ingested The vendor publishes a per-GB or per-day ingest rate rather than quote-only pricing.	No	Yes
Self-hosted SIEM deployment The product can run on the customer's own servers or private cloud rather than SaaS only.	No	No
Overall Rating	No reviews yet	No reviews yet

Exabeam 10/18 features

Out-of-the-box log source connectors: Yes
Custom log parser builder: Yes
Normalisation to a common event schema: Yes
Prebuilt correlation rule library: No
Sigma rule import: Yes
User and entity behaviour analytics: Yes
Risk-based alerting on entity scores: No
ATT&CK coverage map of active rules: Yes
Threat intel indicator matching on ingest: No
Full-text and structured search language: No
Tiered long-term log storage: No
Federated search across external stores: Yes
Incident queue with analyst assignment: Yes
Native automation playbooks in the SIEM: No
Compliance report packs for PCI and HIPAA: Yes
Natural-language query assistant: Yes
Pricing published per GB ingested: No
Self-hosted SIEM deployment: No

No reviews yet

Microsoft Sentinel 14/18 features

Out-of-the-box log source connectors: Yes
Custom log parser builder: Yes
Normalisation to a common event schema: Yes
Prebuilt correlation rule library: Yes
Sigma rule import: No
User and entity behaviour analytics: Yes
Risk-based alerting on entity scores: No
ATT&CK coverage map of active rules: Yes
Threat intel indicator matching on ingest: Yes
Full-text and structured search language: Yes
Tiered long-term log storage: Yes
Federated search across external stores: Yes
Incident queue with analyst assignment: Yes
Native automation playbooks in the SIEM: Yes
Compliance report packs for PCI and HIPAA: Yes
Natural-language query assistant: No
Pricing published per GB ingested: Yes
Self-hosted SIEM deployment: No

No reviews yet

Pricing

Exabeam

Quote only, after a demo. New-Scale Fusion, New-Scale SIEM and New-Scale Analytics run on Google Cloud. No trial.

See all plans

Microsoft Sentinel

Usage-based, USD, East US: analytics tier $4.30 per GB ingested pay-as-you-go, or commitment tiers from $296 a day for 100 GB; data lake tier from $0.05 per GB.

See all plans

Explore Each Product

Exabeam Read reviews, features & pricing

Microsoft Sentinel Read reviews, features & pricing

Looking for more options?

Browse all SIEM Tools