Microsoft Sentinel vs Google SecOps: how to choose

The short answer: Microsoft Sentinel is Microsoft's cloud-native SIEM, with built-in automation, billed by the data tier your logs land in. Google Security Operations (Google SecOps) is sold in three packages priced on ingestion volume, with 12 months of searchable data included. Sentinel fits estates built on Microsoft 365 and Defender; Google SecOps fits high or growing log volumes from mixed sources.

Neither platform is the wrong choice in absolute terms. What separates them is the shape of the bill, how far back you can search without extra cost, how threat intelligence and automation are packaged, and where your data already lives. This comparison uses only the vendors' own documentation: Microsoft Learn for Sentinel, Google Cloud documentation for Google SecOps. We name no list prices, because they change and depend on the contract.

What Microsoft Sentinel is

Microsoft Sentinel is a SIEM that runs on Azure. Data from Microsoft services, other clouds and on-premises sources is streamed into an Azure Log Analytics workspace in your own tenant, which is where you choose region, retention and deletion policies. Connectors cover Microsoft Entra ID, Azure and Microsoft 365 out of the box, alongside third-party products through CEF, Syslog or REST API. Sentinel normalises data with the Advanced Security Information Model (ASIM), at query time or at ingestion, and queries are written in KQL.

One change matters for anyone evaluating it today. Microsoft Learn states that after 31 March 2027 Sentinel will no longer be supported in the Azure portal and will be available only in the Microsoft Defender portal. Sentinel is generally available in the Defender portal even for customers without Defender XDR or an E5 licence, so this is a change of console, not of licence. Any new project should be designed around the Defender portal from day one.

What Google Security Operations is

Google SecOps is offered in three packages: Standard, Enterprise and Enterprise Plus. Every package ingests telemetry, normalises it into the Unified Data Model (UDM) and lets you search and investigate on that single model, whatever the source. Detection rules are written in YARA-L 2.0. SOAR is part of the platform: the Standard package includes base SOAR capabilities and over 300 prebuilt integrations.

The package decides how much sits on top. Enterprise adds UEBA, curated detections and Gemini in Security Operations; Enterprise Plus adds Google Threat Intelligence Enterprise Plus, advanced data pipeline management and BigQuery storage. If you want the wider selection criteria before narrowing down to these two, our guide to choosing a SIEM security tool covers them.

Cost model: what each one charges for

Both bills follow data volume. The difference is in what else moves the number.

Microsoft Sentinel: tiers, meters and free sources

Microsoft Learn puts it plainly: "Pricing is based on the tier that the data is ingested into."

• Analytics tier. Pay-as-you-go by default, or commitment tiers that start at 100 GB per day. You can raise a commitment tier at any time; lowering it is only allowed every 31 days. Usage above the commitment is billed at the same effective rate.
• Data lake tier. Billed on separate meters: ingestion, data processing, storage (calculated on a 6:1 compression rate) and queries, charged per GB of data scanned.
• Free data sources. Azure Activity logs, Office 365 audit logs (SharePoint, Exchange admin activity, Teams) and security alerts from the Defender family are not charged. Microsoft also notes that the raw logs of several Defender, Entra ID and Azure Information Protection data types are paid.
• Services around Sentinel. Playbooks run on Azure Logic Apps, and some connectors use Azure Functions; both carry their own charges.

The practical effect: a mostly Microsoft estate where alerts and audit logs dominate can keep the bill low, while firewall, proxy and endpoint telemetry from other vendors lands on the paid tiers.

Google SecOps: one package, one volume

Google's package overview states that "The pricing for all packages is based on ingestion volume." Hot retention for 12 months is part of the package, described in the Standard tier as searchable at no additional cost beyond ingestion. You choose capability by package, not by meter, so the bill has fewer moving parts. Volume control still matters: Standard offers limited filtering and transforms, while Enterprise adds advanced data processing to filter, redact and transform data from cloud and on-premises sources.

The factors that move the bill in practice

1. Daily log volume, and how fast it grows.
2. The share of your data that comes from Microsoft sources Sentinel ingests at no charge.
3. How many months of data have to stay searchable.
4. The features you need: in Google SecOps, UEBA and Gemini start from Enterprise; in Sentinel, automation and some connectors add Azure services.
5. Who tunes the sources, because every noisy log you do not filter is paid for on both platforms.

Retention: how far back you can search

The entry point of an intrusion is often weeks before the alert. Retention decides whether you can find it.

• Google SecOps. The documentation states: "By default, Google retains 12 months of your data". The period can be extended up to five years as part of the purchase order.
• Microsoft Sentinel. Data in the workspace is retained at no charge for the first 90 days. Beyond that, retention is charged at standard Log Analytics prices, or data can move to the lower-cost data lake tier, which bills storage and every query.

This has a regulatory side. Under Article 23(4) of Directive (EU) 2022/2555 (NIS2), essential and important entities submit a final report no later than one month after the incident notification, including the type of threat or root cause. If the logs from the weeks when the attacker got in have expired, or are expensive to query, the root cause becomes a guess. More on the obligations in our NIS2 service.

Threat intelligence

Microsoft Sentinel

Sentinel ingests and manages threat intelligence as STIX objects from several routes: the Microsoft Defender Threat Intelligence data connector, a TAXII connector for standard feeds, and an upload API for threat intelligence platforms. The Defender Threat Intelligence connector comes in a standard version with public indicators and open-source intelligence, and a premium version that adds Microsoft's own indicators and Microsoft-enriched OSINT, which requires its own licence.

Google SecOps

Here threat intelligence scales with the package. Standard works with your own feeds; Enterprise adds Google-enriched open-source intelligence, including Google Safe Browsing; Enterprise Plus includes Google Threat Intelligence Enterprise Plus, which Google describes as combining Google's security telemetry, VirusTotal's malware database and Mandiant's frontline expertise, with threat actor profiles, vulnerability reports and monitoring for leaked credentials. Enterprise Plus also adds what Google lists as Emerging and Active IR Threat Detections.

SOAR and AI assistance

Microsoft Sentinel

Automation rules handle incidents centrally: tagging, assigning, closing and launching playbooks. Playbooks are workflows built in Azure Logic Apps, with a large connector gallery for systems such as ServiceNow and Jira. For AI, Security Copilot runs on Security Compute Units (SCUs). Microsoft now includes it for eligible Microsoft 365 E5 and E7 customers, with 400 SCUs a month for every 1,000 paid user licences, up to 10,000 SCUs a month. Microsoft states that usage beyond the included SCUs will be throttled at a future date, with an option to scale beyond it on a pay-as-you-go basis. Microsoft's onboarding guide notes that whether you need to purchase capacity depends on holding an E5 or E7 licence.

Google SecOps

Base SOAR capabilities are in every package, with over 300 prebuilt integrations to orchestrate response; Enterprise and Enterprise Plus add multi-environment (MSSP) support. Gemini in Security Operations is included from the Enterprise package: Google's documentation lists natural language search over your data, case summaries, and drafting playbooks and detection rules.

Where your data lives in Europe

Both vendors document European options, and both are worth reading next to your privacy and sector requirements.

• Sentinel stores raw data in the region of the Log Analytics workspace and, for workspaces located in Europe, processes customer data in Europe. Supported regions include North and West Europe, France Central, Germany West Central, Italy North, Sweden Central, Switzerland North and UK South, among others.
• Google SecOps offers a Europe multi-region with data centres in Belgium, the Netherlands and Finland, and single regions such as London, Frankfurt, Zurich, Paris and Turin.

When to choose which

1. Your estate is Microsoft 365, Defender and Entra ID, and log volumes are moderate. Sentinel starts with an advantage: native connectors, free ingestion of alerts and Office 365 audit logs, and Security Copilot capacity if you hold E5 or E7. Check how much third-party telemetry you add, because that is what lands on the paid tier.
2. You have high or growing volumes from many vendors. Google SecOps tends to give a more predictable bill: one ingestion-based package, 12 months searchable included, one data model for every source.
3. Compliance or investigations need a year or more of searchable data. Compare the cost of Sentinel beyond 90 days, including data lake queries, against retention already in the Google SecOps package.
4. Threat intelligence is a priority. Compare the premium Defender Threat Intelligence licence with Google SecOps Enterprise Plus, which bundles Google Threat Intelligence and Mandiant intelligence.
5. You are leaving a legacy SIEM. Rules will be rewritten either way, into KQL or YARA-L. Use the move to rethink sources and detections rather than copy the old setup.

Why we build on Google SecOps

To be transparent: AmagisTech is a Google Cloud partner, and our managed detection and response service runs on Google Security Operations. Not because Sentinel is a poor platform, but because for mid-market organisations with lean security teams, an ingestion-based package, a year of searchable data and a single data model mean fewer surprises month after month. Predictability is worth as much as raw capability when there are only a few people reading the alerts.

The right answer still comes from scoping, not from a brand: log volume, sources, retention required by compliance, and who covers alerts at night. Our observability and SecOps service starts from exactly those numbers.

In short: Microsoft Sentinel is strongest inside a Microsoft estate with manageable third-party volumes; Google SecOps is strongest when log volumes grow, sources are mixed and long retention matters. If you want to test your own numbers against both models, talk to our team.