Elastic Security vs Microsoft Sentinel when the SIEM bill is set by gigabytes, not features

At 100 GB a day, a SIEM invoice is mostly an ingest meter, and both of these vendors publish theirs. Elastic Security and Microsoft Sentinel both sell cloud SIEM with detection rules, investigation, and automation. They split on whose data gravity wins: the Elastic Stack and its endpoint agent, or Azure and the Microsoft security graph.

Elastic Security runs SIEM and security analytics on the Elastic Stack, with Serverless Security Analytics Essentials and Complete metered by ingest and retention per GB, and Elastic Defend endpoint protection without a per-endpoint fee since 23 Mar 2026. Microsoft Sentinel runs on Log Analytics workspaces in Azure, metered by analytics GB on pay-as-you-go or commitment tiers, and is moving into the unified Microsoft Defender portal.

Buy Elastic Security when SIEM data should live on the Elastic Stack with endpoint protection and published per-GB serverless meters. Buy Microsoft Sentinel when SIEM should sit in Azure beside Defender XDR and Microsoft 365 data sources.

Overview

	Elastic Security	Microsoft Sentinel
Primary use case	SIEM and security analytics on the Elastic Stack with prebuilt detection rules, AI-assisted triage, investigation timelines, and Elastic Defend endpoint protection	Cloud-native SIEM and SOAR on Azure Log Analytics with analytics rules, data connectors, hunting, and playbooks on Logic Apps, integrated with Defender XDR
Day-to-day workflow	Ingest through Elastic Agent and integrations, tune prebuilt rules, triage alerts with Attack Discovery, and investigate in timelines and ES|QL	Connect data sources through connectors, run analytics rules and UEBA, triage incidents in the Defender portal or Azure portal, and automate with playbooks
Main buying consideration	Serverless Essentials ingest as low as USD 0.09 per GB and retention USD 0.017 per GB per month. Complete as low as USD 0.11 per GB and USD 0.019 per GB per month. Hosted deployments are resource-based	Analytics pay-as-you-go USD 4.30 per GB in East US. Commitment tiers from 100 GB per day at USD 296 per day to 50,000 GB per day. Overage billed at the selected tier’s effective rate

We reviewed Elastic Security Serverless pricing and the endpoint fee change, Elastic Security detection and investigation documentation, plus the Microsoft Sentinel pricing page, commitment tier terms, and a Best Buy customer story, on 10 Oct 2026. We did not run either SIEM in a paid tenant.

Elastic Security

Microsoft Sentinel

Editions and pricing

Both vendors publish per-GB meters. The units differ: Elastic Serverless bills ingest and retention separately with tiered floors, Sentinel bills analytics ingest with retention priced separately.

	Elastic Security	Microsoft Sentinel
How it is sold	Serverless Security Analytics Essentials and Complete, monthly pay-as-you-go or prepaid Elastic Consumption Units, or Elastic Cloud Hosted and self-managed by resources	Pay-as-you-go analytics per GB or commitment tiers per day in Azure, billed through the Azure subscription
Figure on the public page	Essentials from USD 0.09 per GB ingest and USD 0.017 per GB per month retention. Complete from USD 0.11 per GB and USD 0.019 per GB per month. Egress 50 GB free then billed	USD 4.30 per GB analytics in East US. 100 GB per day commitment at USD 296 per day. Tiers run to 50,000 GB per day
Endpoint protection	Elastic Defend included without a separate per-endpoint fee as of 23 Mar 2026	Endpoint EDR comes from Defender for Endpoint licensing, separate from Sentinel ingest

Detection and investigation

Both ship prebuilt detections, hunting, and AI-assisted triage. The split is the query language and where incidents are worked.

	Elastic Security	Microsoft Sentinel
Detection object	Prebuilt detection rules mapped to MITRE ATT&CK, machine learning jobs, and Attack Discovery for AI-assisted alert correlation	Analytics rules in KQL, Fusion multistage detection, and UEBA anomalies on Log Analytics data
Query and hunting	ES|QL and KQL in Discover and timelines, with osquery for live endpoint queries	KQL hunting queries, notebooks, and livestream across workspace tables
Incident console	Alerts and cases in the Elastic Security app	Incidents in the unified Microsoft Defender portal with Defender XDR, or in the Azure portal

Data sources and automation

Both ingest broad third-party data. The documented split is an open agent ecosystem versus native Microsoft connectors and Logic Apps.

	Elastic Security	Microsoft Sentinel
Collection	Elastic Agent with Fleet-managed integrations, plus Beats and Logstash	Data connectors including free ingestion of certain Microsoft sources such as Azure Activity and Office 365 audit logs, plus AMA and syslog or CEF collection
Endpoint	Elastic Defend for prevention, detection, and response on the same agent	Defender for Endpoint signals stream in through the Defender XDR connector
Automation	Elastic Workflows and response actions on Elastic Defend hosts	Automation rules and playbooks built on Azure Logic Apps

Favor Elastic Security when the documented requirement is Serverless per-GB ingest and retention meters, ES|QL investigation, and Elastic Defend on the same agent without a per-endpoint fee. Favor Microsoft Sentinel when the documented requirement is Azure Log Analytics with commitment tiers, native Microsoft connectors, Logic Apps playbooks, and incidents in the unified Defender portal.