SIEM platforms · September 2026 Edition
Microsoft Sentinel vs Wazuh
Nine of twelve models named Microsoft Sentinel first on the direct prompt; zero named Wazuh. Microsoft Sentinel was named by twelve of the twelve models and Wazuh by ten and Microsoft Sentinel carries 56 labels and Wazuh 15, so the shares are not directly comparable.
Named in four categories this edition.
Named in nine categories this edition.
First-choice share41%18%Of first choices across the direct, paraphrase, budget and scale prompts, 0 to 100.
Negative rate12%7%Negative labels as a share of the product's labels, 0 to 100.
Rank in category#1#3A position in a field of 16; printed, not drawn.
Labels5615A count; the two differ.
The two percentage rows are drawn on one 0 to 100 track, Microsoft Sentinel reading right to left. Rank and label count are printed, not drawn.Rapid7 InsightIDR was named alongside these two in eleven of the twelve direct answers. Microsoft Sentinel vs Rapid7 InsightIDR · Rapid7 InsightIDR vs Wazuh
Share is the count of first choices across the direct, paraphrase, budget and scale prompts over all twelve models, for a mid-market B2B company; rank is within the category; every quote names the model and the prompt it came from. Both figures come from the SIEM platforms page.
By framing
How many of the twelve models made each the first choice, per way of asking, and how many argued against it.
Microsoft SentinelFirst choices, of twelve modelsWazuh
Direct90
Paraphrase80
Comparative30
Budget-constrained091 against Microsoft Sentinel
Scale-constrained30
Negative106 against Microsoft Sentinel · 1 against Wazuh
Bars are first choices, 0 to 12 each sideModels that argued againstA model can name both, so the two sides of a row do not sum to twelve.
The direct prompt
The plain question, one answer per model, grouped by where Microsoft Sentinel and Wazuh stood in it.
Microsoft Sentinel first, Wazuh not the choice
9 of 12 modelsWazuh was named in the answer but not as the choice, or not at all.GPT-5.4 miniMicrosoft Sentinel alternatives: Google Security Operations, Splunk Enterprise Security
Gemini 3.5 FlashBlumira, Huntress Managed SIEM, Microsoft Sentinel alternatives: Rapid7 InsightIDR, Sumo Logic
Perplexity SonarMicrosoft Sentinel alternatives: Rapid7 InsightIDR
Mistral SmallMicrosoft Sentinel, Rapid7 InsightIDR alternatives: ManageEngine Log360
DeepSeek V4 FlashMicrosoft Sentinel, Rapid7 InsightIDR alternatives: CrowdStrike Falcon Next-Gen SIEM, Elastic Security, LogRhythm
Llama 4 MaverickMicrosoft Sentinel, Rapid7 InsightIDR alternatives: ManageEngine Log360
Qwen 3.7 FlashMicrosoft Sentinel, Rapid7 InsightIDR alternatives: LogRhythm
GLM 4.7 FlashXMicrosoft Sentinel alternatives: Elastic Security, IBM QRadar, LogRhythm, Rapid7 InsightIDR
MiniMax M2.5Microsoft Sentinel, Rapid7 InsightIDR alternatives: Elastic Security, LogRhythm
Neither was the first choice, one was named
3 of 12 modelsThe answer put something else first and named one of the two as an alternative.Claude Haiku 4.5ManageEngine Log360 alternatives: Blumira, Microsoft Sentinel, Rapid7 InsightIDR
Grok 4.1 FastRapid7 InsightIDR alternatives: Blumira, Elastic Security, LogRhythm, ManageEngine Log360, Microsoft Sentinel
Kimi K2Rapid7 InsightIDR alternatives: CrowdStrike Falcon Next-Gen SIEM, Elastic Security, Google Security Operations, Microsoft Sentinel
Bold names in an answer are the products the judge labeled a first choice; a model naming several gives each of them that label. The full answer text for every row is in the record.
By buyer segment
The same question asked on behalf of a different buyer. Each standing is computed within its segment and they are never added together. The figures above are the mid-market standing, which is the one the category orders by.
Small business
Microsoft Sentinel leads by eleven points.
Microsoft Sentinel28%#2 of 14Wazuh17%#3 of 14Mid-marketThe figures above
Microsoft Sentinel leads by twenty-two points.
Microsoft Sentinel41%#1 of 16Wazuh18%#3 of 16Enterprise
Microsoft Sentinel leads by thirty points.
Microsoft Sentinel30%#1 of 12Wazuh0%#– of 12What the models said about Microsoft Sentinel
Every negative label with a quote, up to three, then the highest-weighted positives, up to three. Six of seven in this category shown.
“Sentinel is an excellent SIEM, but its value proposition changes drastically depending on your architecture.” Gemini 3.5 Flash · negative prompt · soft negative
“not "bad," but you should be careful with licensing, ingestion costs, and operational surprises” Perplexity Sonar · negative prompt · soft negative
“Not on the "avoid" list, but cautionary because non-Microsoft data sources get expensive to ingest” DeepSeek V4 Flash · negative prompt · soft negative
“Microsoft Sentinel or LogRhythm are top choices due to their balance of features, ease of deployment, and support for mid-market teams.” Mistral Small · paraphrase prompt · first choice
“I'd recommend starting with Microsoft Sentinel due to its scalability, integration capabilities, and consumption-based pricing model” MiniMax M2.5 · paraphrase prompt · first choice
“The best SIEM platform for a mid-market B2B company is likely to be Microsoft Sentinel, Rapid7 InsightIDR, or ManageEngine Log360” Llama 4 Maverick · direct prompt · first choice
What the models said about Wazuh
Every negative label with a quote, up to three, then the highest-weighted positives, up to three. Four of four in this category shown.
“Use with extreme caution: Wazuh (only if you have engineering resources)” Qwen 3.7 Flash · negative prompt · soft negative
“Wazuh is one of the most popular open-source SIEM platforms available today... the software is completely free to use, making it attractive for organizations with limited budgets.” Claude Haiku 4.5 · budget prompt · first choice
“If you have zero budget for software licenses but have a capable, Linux-savvy system administrator on your team, Wazuh is the undisputed champion.” Gemini 3.5 Flash · budget prompt · first choice
“the strongest overall pick is usually Wazuh if you can handle some engineering and operations work, because it has no software license cost” Perplexity Sonar · budget prompt · first choice
Also compared
Comparisons are drawn for the top three products in each category. The output is the models' output; nothing here is a recommendation by the index.