Threat detection, posture & security operations
Amazon Detective vs Microsoft Sentinel
Amazon Detective maps most closely to Microsoft Sentinel's incident investigation, entity pages, and UEBA, now in the Microsoft Defender portal.
Sentinel is a full SIEM and SOAR, while Detective is an investigation tool, and AWS has no first-party SIEM.
Side-by-side comparison
| Aspect | Amazon Web Services | Microsoft Azure |
|---|---|---|
| Service | Amazon Detective | Microsoft Sentinel |
| Lifecycle | Generally available | Generally available |
| What it is | Automatically collects log data into a behavior graph and links activity to GuardDuty findings, so you can investigate and group related security findings. | Cloud-native SIEM and SOAR with data connectors, analytics rules, UEBA, hunting, incidents, and playbooks. Sentinel is moving to the Microsoft Defender portal and is no longer supported in the Azure portal after March 31, 2027. |
| Pricing model | Per GB of data ingested into the behavior graph (with a 30-day free trial). | Per GB ingested (pay-as-you-go or commitment tiers) into analytics tiers, with cheaper data lake tiers. |
| Docs | Amazon Detective docs | Microsoft Sentinel docs |
| Pricing page | Amazon Detective pricing | Microsoft Sentinel pricing |
| Exams | SCS-C03 | SC-200 |
Key differences
- Scope. Detective builds a behavior graph from AWS logs and GuardDuty findings automatically, with no queries to write. Sentinel ingests data from many sources, uses KQL analytics rules, and adds playbooks for automated response.
- Portal. Sentinel is moving to the Microsoft Defender portal and won't be supported in the Azure portal after March 31, 2027.
Pricing summary
Pricing models only. No prices are quoted because they change by region and over time.
- AWS
- Per GB of data ingested into the behavior graph (with a 30-day free trial). Amazon Detective pricing →
- Azure
- Per GB ingested (pay-as-you-go or commitment tiers) into analytics tiers, with cheaper data lake tiers. Microsoft Sentinel pricing →
Certification exam mapping
| Exam | Provider | Level | Status |
|---|---|---|---|
| AWS Certified Security – Specialty SCS-C03 | AWS | Specialty | current The current code (SCS-C03) is taken from the exam-prep link on the official certification page. Simplified Chinese, Spanish (Latin America), and Portuguese (Brazil) versions retire after Dec 31, 2026. |
| Microsoft Certified – Security Operations Analyst Associate SC-200 | Azure | Associate | current |
Relevance is based on each exam's published scope, not a line-by-line objective match. Check the official study guide.
Verification notes
- Microsoft Sentinel won't be supported in the Azure portal after March 31, 2027. Study material showing Azure portal steps is aging.
FAQ
What is the Azure equivalent of Amazon Detective?
Amazon Detective maps most closely to Microsoft Sentinel's incident investigation, entity pages, and UEBA, now in the Microsoft Defender portal. Sentinel is a full SIEM and SOAR, while Detective is an investigation tool, and AWS has no first-party SIEM.
How does pricing compare between Amazon Detective and Microsoft Sentinel?
AWS: Per GB of data ingested into the behavior graph (with a 30-day free trial). Azure: Per GB ingested (pay-as-you-go or commitment tiers) into analytics tiers, with cheaper data lake tiers. Check the official pricing pages for current rates.
Which certification exams cover this topic?
AWS Certified Security – Specialty (SCS-C03); Microsoft Certified – Security Operations Analyst Associate (SC-200).