Microsoft Azure → Amazon Web Services
AWS equivalent of Microsoft Sentinel
The closest AWS equivalent of Microsoft Sentinel is Amazon Detective.
About Microsoft Sentinel
| Provider | Microsoft Azure |
|---|---|
| Status | Generally available |
| What it is | Cloud-native SIEM and SOAR with data connectors, analytics rules, UEBA, hunting, incidents, and playbooks. Sentinel is moving to the Microsoft Defender portal and is no longer supported in the Azure portal after March 31, 2027. |
| Documentation | learn.microsoft.com |
| Pricing | Official pricing page |
AWS mappings (1)
| Capability | AWS equivalent | Match |
|---|---|---|
| Security investigation and incident analysis | Amazon Detective | Partial match |
Threat detection, posture & security operations(1)
Security investigation and incident analysis Partial match
Amazon Detective maps most closely to Microsoft Sentinel's incident investigation, entity pages, and UEBA, now in the Microsoft Defender portal. Sentinel is a full SIEM and SOAR, while Detective is an investigation tool, and AWS has no first-party SIEM.
- Scope. Detective builds a behavior graph from AWS logs and GuardDuty findings automatically, with no queries to write. Sentinel ingests data from many sources, uses KQL analytics rules, and adds playbooks for automated response.
- Portal. Sentinel is moving to the Microsoft Defender portal and won't be supported in the Azure portal after March 31, 2027.