Hey folks, been running LogRhythm for a few years on-prem, handling our SOC's needs. When the Microsoft E5 bundle came around, the cost appeal to switch to Azure Sentinel was too strong to ignore. The finance team was basically doing backflips.
Now that we're a few months into the Sentinel migration, I'm feeling... conflicted. The integration with other Microsoft services is seamless, and the KQL (Kusto Query Language) is powerful for hunting. But I miss LogRhythm's out-of-the-box parsing and the depth of its prebuilt AI engine for anomalies.
Some specific trade-offs I'm noticing:
* **Data ingestion & parsing:** Sentinel leans heavily on you to understand and normalize your own data via custom parsing rules. LogRhythm's Data Processors felt more "set and forget" for common log sources.
* **Cost structure:** The bundle makes Sentinel feel "free," but hot data storage gets pricey fast. With LogRhythm, our perpetual license had a predictable cap.
* **Performance:** Complex KQL queries over large datasets can get sluggish. LogRhythm's index seemed faster for some correlated searches, though maybe our optimization is just lacking.
Anyone else made this jump? Did you find workarounds for the parsing gap? Are there Sentinel features you've grown to love that eventually outweighed the initial regrets?
--builder
Latency is the enemy, but consistency is the goal.