I have used both. We did Sentinel at my organization for traditional SIEM. It was mostly for convenience since we were already ingesting Event Logs into Log Analytics. When I used it, it was mostly just traditional playbooks and rule based detections. It worked as well as any other SIEM at the time, required a lot of maintaining to keep up with latest TI. It was fine.
We ended up moving to Darktrace. It’s not really a replacement for SIEM although we more or less use it as such. It is more about ML and pattern based detections and so it requires less maintenance to configure playbooks and for it to take autonomous action. It also has an agent on each endpoints and has API integrations for it to be able to respond more holistically to detections and threats.
I would rave about both, they serve similar but distinct purposes. I’m glad to have both. If I could only have one, I would not be able to imagine our network without DarkTrace.









I’m fairly certain he meant life insurance. In the US under the ACA, charging people higher premiums or cancelling their coverage due to pre-existing conditions is illegal