Splunk SIEM or Sentinel? Azure Portal Ends Mar. 31 [2026]

Microsoft will retire the Microsoft Sentinel experience in the Azure portal, and the destination is the Microsoft Defender portal. Microsoft already started automatic onboarding of managed customers who had not moved, with the first wave beginning September 9, 2026. For anyone running Sentinel today, that turns a quiet platform choice into a dated project, and it is a fair moment to price a Splunk SIEM, CrowdStrike Falcon Next-Gen SIEM and Palo Alto Networks’ Cortex XSIAM against it.

Sentinel itself is not being discontinued, renamed or sold. Microsoft keeps the product name and sells it commercially, and it pitches the Defender portal as the home of a unified security operations experience. That pitch comes with analyst backing, including Microsoft’s report of being named an overall leader in KuppingerCole’s 2026 Emerging AI SOC report. The deadline is about the portal, not the product, which changes the math on how much a switch is worth.

This comparison covers the four platforms as they stand on October 27, 2026: Splunk Enterprise Security (the Splunk SIEM), Microsoft Sentinel, CrowdStrike Falcon Next-Gen SIEM and Cortex XSIAM. If you want a straight feature matchup without the deadline angle, our earlier Splunk vs Sentinel vs Cortex XSIAM market-share breakdown covers that ground. Here the question is narrower: stay on Sentinel and change portals, or use the deadline to switch, and what each path costs in effort.

A note on data quality before we start. None of the four vendors publishes a universal dollar price for its SIEM, and no independent lab runs a head-to-head detection benchmark across all four. Where this article cites numbers, they come from vendor pages fetched this week, analyst reports and vendor-sponsored studies, and each is labeled by source. Where a vendor offers no public figure, we say so instead of filling the gap.

·

Google · Preferred Sources

Don't miss new tech stories on Google

Add Tech Insider once in the Google app and our stories appear in your news suggestions.

Add Now

What Changes for Sentinel Customers When the Azure Portal Experience Retires

The confirmed change is narrow and specific. Microsoft says the Microsoft Sentinel experience in the Azure portal is being retired, and customers are meant to work in the Microsoft Defender portal from then on. Microsoft’s overview documentation and pricing pages both point there, and its September 2026 partner announcements describe the onboarding program that moves managed customers across.

The September 9, 2026 start of automatic onboarding matters more than the retirement date for many teams. Microsoft said affected administrators would see an in-portal banner and receive an email about 30 days before their onboarding. If you ignore those notices, Microsoft moves you anyway. Teams that wanted a controlled cutover with a tested rollback now have to schedule it before Microsoft’s calendar does it for them.

Multiple-workspace customers face the sharpest edge. For managed customers with several Sentinel workspaces, Microsoft selects a primary workspace for Microsoft Defender XDR alerts and incidents. Dependent content in the secondary workspaces, meaning analytics rules, automation rules, playbooks and workbooks, may stop functioning unless it is migrated. Managed service providers and large enterprises that split workspaces by business unit, region or data residency need to audit that content first.

What Microsoft has not promised

Microsoft’s documentation does not give one universal dollar price for Sentinel, because the amount varies by region, ingestion tier, retention and usage. It also does not publish a numbered Sentinel version the way Splunk numbers Enterprise Security releases. An unofficial expectation circulates that Sentinel management APIs will keep working after the Azure-portal experience retires, but we could not confirm that from an official page, so treat API continuity as a question to put to your Microsoft account team in writing. Teams with Terraform, ARM or Bicep automation should ask first, because the answer decides how much pipeline code needs rework.

The retirement does not force a SIEM replacement. It forces a console change, a possible workspace consolidation and a change in how detections get written. Microsoft says custom detections are now the preferred way to create new detections across Sentinel and Defender XDR, with integration into Defender data and remediation actions. Those three items are the real migration scope if you stay. If you leave, the scope is every rule, parser, playbook and dashboard you own, which is a far bigger number.

Microsoft’s Sentinel pricing page also advertises a limited-time promotion on a 50 GB commitment tier, while its standard commitment tiers start at 100 GB per day. Customers ingesting less than 100 GB per day can read that as a signal about where Microsoft sees the sweet spot for committed spend. For cost modeling across vendors, see our Sentinel vs Splunk vs Sophos Fusion SIEM cost gap analysis, which walks through ingest-priced scenarios in more detail.

Splunk SIEM, Sentinel, Falcon and XSIAM at a Glance

The table below uses only details confirmed on vendor pages or in vendor documentation fetched on October 27, 2026. Cells marked “Not published” mean the vendor offers no public figure, and cells marked “Not confirmed” mean we could not verify the item from a vendor page this week.

Spec	Splunk Enterprise Security	Microsoft Sentinel	CrowdStrike Falcon Next-Gen SIEM	Cortex XSIAM
Owner	Splunk (part of Cisco)	Microsoft	CrowdStrike	Palo Alto Networks
Newest version on record	ES 8.7.2 (Splunkbase listing, Oct. 23, 2026)	No numbered version	No numbered version (major release announced Mar. 23, 2026)	XSIAM 3.6 (July 2026 Cortex release)
Delivery	Premium app on Splunk Enterprise or Splunk Cloud Platform	Cloud-native SIEM and SOAR, Defender portal	Cloud, part of the Falcon platform	Cloud platform on Cortex Extended Data Lake
Pricing basis	Daily indexing volume, vCPU or SVC, or activity-based	Pay-as-you-go or commitment tiers	Ingestion-based, Falcon Flex licensing	Not published
Editions or packaging	Essentials and Premier	Analytics tier with commitment tiers from 100 GB per day	Next-Gen SIEM, 365 Day Retention, Additional Ingestion, Complete upgrade	Platform plus a managed option operated by Unit 42
Public dollar price	No, contact sales	No, varies by region and tier	No	No
Entry offer on record	Not published	First 10 GB per day free for 31 days on a new workspace	10 GB per day free tier for Falcon Insight XDR customers, 7-day retention	Not published
Third-party endpoint data	Content for CrowdStrike FDR compatibility (ESCU 6.8.0)	Native Microsoft Defender integration	Third-party EDR support starting with Microsoft Defender, no Falcon sensor needed	Palo Alto firewall and Prisma SASE log ingestion
Newest AI direction	AI SOC Analyst, Detection Builder Agent, Connector Builder Agent (Premier)	AI playbook generation (GA May 2026), Security Copilot	Falcon Fusion SOAR workflows (premium actions need a paid tier)	Agentic SOC capabilities (3.5 and 3.6)
Gartner MQ for SIEM (Oct. 2025)	Not confirmed	Leader	Visionary (per CrowdStrike’s page)	Not confirmed
IDC MarketScape SIEM 2026	Not confirmed	Leader	Leader	Not confirmed
PHP2Shell response (Oct. 2026)	Emergency ESCU 6.9.1 on Oct. 22	No update identified	Correlation rules and dashboard section, reported Oct. 23	Palo Alto states XSIAM was not impacted
Lifecycle status	Active, premium product	Active, Azure-portal experience retires Mar. 31, 2027	Active, expanding	Active

Two rows deserve a second look. The “Newest version” row shows how differently the vendors ship. Splunk and Palo Alto number their releases, while Microsoft and CrowdStrike run continuously updated cloud services, so a version number tells you less about a cloud SIEM than a monthly release log does. And the analyst rows show Microsoft and CrowdStrike on the same IDC list, with Microsoft placed higher in Gartner’s October 2025 quadrant, where CrowdStrike’s own page lists it as a Visionary.

Current Versions and Release Cadence

Release cadence tells you how fast a platform adds detection content and how often you have to touch your own estate. The four vendors differ sharply here, and the cadence has a direct effect on staffing.

Splunk: numbered releases and a separate content stream

Splunk Enterprise Security 8.7.0 shipped on September 2, 2026, 8.7.1 followed on October 1, and Splunkbase now lists 8.7.2 with an October 23, 2026 update date. Separately, Splunk Security Content Updates (ESCU) ship detections on their own track. ESCU 6.8.0 landed October 7, 6.9.0 on October 21 and an out-of-band 6.9.1 on October 22. Splunk Cloud Platform 10.6 and Splunk Enterprise 10.6 were announced September 30, 2026, and Splunk Enterprise 9.3 and earlier are out of support.

Microsoft, CrowdStrike and Palo Alto: rolling cloud updates

Microsoft publishes a regular What’s New post for Sentinel. The September 2026 edition reported that Case Management became available in Defender beginning September 23. CrowdStrike ships through seasonal platform releases (the Spring 2026 release came in March) and through content package updates, such as the one that added PHP vulnerability coverage in late October.

Why this matters for a migration decision: a platform that changes monthly rewards teams with engineering time to read release notes, while a platform that ships numbered releases lets you pin and test an upgrade. Neither model is better in general. The wrong fit shows up as either missed capabilities (the team never reads the notes) or surprise changes in production (the team never tests).

Splunk SIEM: Where Enterprise Security Stands in 2026

People searching for a Splunk SIEM are really looking for Splunk Enterprise Security, the premium application that sits on top of Splunk Enterprise or Splunk Cloud Platform. It is not a standalone product, which is the first thing to understand when comparing costs. You pay for the platform ingest or compute and for the ES license on top, and Splunk says customers must contact a sales representative for pricing because its documentation shows no currency-denominated price.

Splunk currently sells two editions, Enterprise Security Essentials and Enterprise Security Premier. Its Cloud Flex documentation lists GB per day, per-SVC and activity-based pricing across those editions, with Standard or Premium Success Plan variants. Splunk’s published Cloud Platform service details describe what the managed cloud service includes, and they are worth reading before you compare against a native cloud SIEM, because platform terms differ in ways a feature table hides.

The 8.7 release made the AI story concrete. Splunk describes an Agentic SOC direction with automation, analyst-capacity scaling, governed autonomous actions and an AI SOC Analyst, and it says capability varies by edition and deployment model. Detection Builder Agent got better reliability with improved SPL guidance and validation. Version 8.7.1 added a Connector Builder Agent, but only for eligible Premier customers. That edition gating is the part buyers miss: some of the newest AI features are Premier-only, so the cheaper edition does not get the full 2026 feature list.

Splunk’s own pages make performance claims worth treating as marketing. They say risk-based alerting can cut alert volumes by up to 90%, and that a unified threat detection, investigation and response platform resolves incidents 55% faster. An IDC Business Value Snapshot sponsored by Splunk (May 2025) puts ROI at 304%, with 64% faster threat identification, a 12-month payback and $4.89M in annual security cost savings. Sponsored studies measure customers who chose the product, so apply a discount, but the direction of the claims (fewer alerts through risk scoring) matches how ES is built.

Under Cisco ownership, Splunk is also tying itself to Cisco telemetry. Splunk’s pricing materials describe expanding visibility by operationalizing more eligible Cisco telemetry at a weighted ingest rate of 50%, which means Cisco-sourced data counts at half its volume against an ingest license. If your network estate is Cisco-heavy, that is a pricing lever the other three vendors do not offer in the same form. Teams weighing Splunk against open options can compare notes with our Splunk vs Wazuh vs Elastic Security app-ecosystem comparison.

Microsoft Sentinel After the Azure Portal

Sentinel’s competitive position in late 2026 rests on gravity. If your identities, email, endpoints and cloud workloads already live in Microsoft products, Sentinel ingests that telemetry with the least friction and the least duplicate licensing. Microsoft describes its differentiator as tight integration with Defender, Security Copilot, UEBA, Microsoft data sources and agentic security workflows. It is not selling a newly numbered release, and the sales pitch is about the platform around it.

Recent engineering changes lean toward detection-as-code. In July 2026 Sentinel added support for custom detections in Sentinel repositories, so teams can manage detections as code with analytics rules, playbooks, parsers and workbooks through GitHub and CI/CD workflows. In May 2026, generating playbooks with AI in Sentinel became generally available. Microsoft also says Security Copilot reduces mean time to respond by 30%, citing a 2025 study titled Generative AI and Security Operations Center Productivity. That figure comes from Microsoft’s own research, so read it as a vendor result.

The pricing structure is consumption-based. A newly enabled Sentinel workspace receives the first 10 GB per day of analytics-log ingestion and Sentinel analysis free for 31 days, with a cap of 20 workspaces per Azure tenant. After that, customers choose pay-as-you-go or a commitment tier, with commitment tiers starting at 100 GB per day. The free trial is the only hands-on entry point among the four platforms that needs no sales call, which makes Sentinel the cheapest to evaluate.

The catch is lock-in of a different kind. Sentinel’s strongest features assume Defender XDR and the Defender portal, so a Sentinel-first SOC that runs a non-Microsoft EDR gets less out of it. That is exactly the gap CrowdStrike targeted when it added third-party EDR support. For a closer look at the endpoint layer underneath, our CrowdStrike Falcon vs Microsoft Defender XDR cost comparison explains how the two ecosystems price their telemetry.

Defender portal readiness checklist

• Confirm every workspace you own and name the primary workspace Microsoft will pick for Defender XDR alerts and incidents.
• List analytics rules, automation rules, playbooks and workbooks that live in secondary workspaces.
• Decide which legacy analytics rules become custom detections, since Microsoft now prefers them for new rule work.
• Test role assignments in the Defender portal, because permissions are managed in a different console from the Azure portal.
• Ask Microsoft in writing which management APIs and automation paths remain after the Azure portal experience retires.

CrowdStrike Falcon Next-Gen SIEM: The Endpoint Vendor’s SIEM

CrowdStrike reported that Falcon Next-Gen SIEM had exceeded $600 million in ending annual recurring revenue, and it said the product was named a Leader in the 2026 IDC MarketScape for Worldwide SIEM. That is a large business for a category CrowdStrike entered after Splunk and Microsoft. It also named the product a Customers’ Choice in the 2026 Gartner Peer Insights Voice of the Customer for SIEM.

The headline capability for Sentinel customers is third-party EDR support. CrowdStrike announced that Falcon Next-Gen SIEM would ingest and correlate data from Microsoft Defender for Endpoint, starting with Microsoft Defender, without requiring a Falcon sensor. CrowdStrike presented this as part of its Falcon Platform Spring 2026 release. The same announcement reportedly introduced or expanded Falcon Onum real-time data pipelines, federated search across third-party data stores, third-party intelligence integration and a Query Translation Agent, according to CrowdStrike. In practical terms, a Sentinel shop can now trial Falcon Next-Gen SIEM while keeping Defender as its sensor.

Data pipeline economics are CrowdStrike’s other argument. On August 31, 2026 the company expanded Project QuiltWorks with data from Abnormal AI, Artemis Security, AttackIQ, ExtraHop, HackerOne, Horizon3, Netskope, Picus Security, Rubrik, SafeBreach, Terra Security and Zscaler. CrowdStrike also said in-pipeline filtering with Falcon Onum can reduce storage costs by up to 50%. That is a vendor claim, not an independently verified result, and the saving depends entirely on how much of your log volume is filterable noise.

Packaging follows the Falcon Flex model, which lets customers shift committed spend across Falcon modules, with SIEM priced by ingestion. CrowdStrike’s licensing FAQ lists entitlements including Falcon Next-Gen SIEM 365 Day Retention, Falcon Next-Gen SIEM Additional Ingestion and Falcon Complete Next-Gen SIEM Upgrade, with no public dollar prices. The company’s page also describes a 10 GB per day free tier for Falcon Insight XDR customers with a dedicated CID, limited to a 7-day retention period and without premium features such as correlation rule templates. For federal buyers, CrowdStrike announced availability on October 1, 2026 through CISA’s SIEMaaS technology stack for eligible civilian agencies running CrowdStrike EDR.

For the competitive matchup against an MDR-first SIEM, see our XSIAM vs CrowdStrike SIEM vs InsightIDR comparison.

Cortex XSIAM: The Firewall Vendor’s SOC Platform

Cortex XSIAM is Palo Alto Networks’ AI-centered security operations platform, and as of October 27, 2026 it remains active under its original name. No official source confirms an acquisition, rename or retirement. A current numbered release and its feature list could not be confirmed from the sources used here, so check Palo Alto Networks directly before comparing versions.

Architecture is the differentiator. Palo Alto positions XSIAM as the security operations platform built on Cortex Extended Data Lake (XDL), and in February 2026 it announced Cortex XDL 2.0 with a lower-cost data-lake tier and expanded data-management capabilities. Its managed offering, Unit 42 Managed XSIAM 2.0, reportedly comes in Pro and Premium tiers. Palo Alto has also shifted the price story for its own customers. On June 2, 2026 it said Enhanced Application Log ingestion for next-generation firewall and Prisma SASE customers would carry no additional charge, and it estimated 20 to 30 percent lower firewall-data ingestion costs in its materials. That estimate is Palo Alto’s own, and it applies mainly to firewall logs, not to your endpoint, identity or cloud data.

On October 21, 2026, Palo Alto announced an integration between XSIAM and NVIDIA DOCA Argus that streams host-activity signals from NVIDIA BlueField infrastructure into the platform for correlation and response. That is a niche capability today, aimed at AI-factory and data-center operators, but it shows where XSIAM wants to differentiate: infrastructure-level telemetry that general-purpose SIEMs do not collect.

The weak spot is transparency. We found no publicly confirmed XSIAM price in the sources checked, so any cost comparison starts with a quote. Teams that want to automate response around XSIAM can also weigh dedicated orchestration tools, a topic we cover in our Torq vs Tines vs Cortex XSIAM alert-reduction comparison.

Analyst Rankings and Benchmark Data

Independent head-to-head SIEM benchmarks are scarce because detection quality depends on the data a customer feeds in. What exists is analyst positioning plus vendor-sponsored studies. The table separates the two and names the source and date on every row so you can weigh each result yourself.

Source	Date	Result	Type
IDC MarketScape: Worldwide SIEM 2026 Vendor Assessment	June 2026	Microsoft and CrowdStrike each named a Leader	Independent analyst
Gartner Magic Quadrant for SIEM	Oct. 8, 2025	Microsoft a Leader, CrowdStrike a Visionary	Independent analyst
KuppingerCole Leadership Compass: Emerging AI SOC	Apr. 20, 2026	Microsoft named an overall leader	Independent analyst
Gartner Peer Insights Voice of the Customer for SIEM	Apr. 15, 2026	CrowdStrike a Customers’ Choice	Customer reviews
IDC Business Value Snapshot for Splunk	May 2025	304% ROI, 64% faster threat identification, 12-month payback	Vendor-sponsored
Microsoft study on Security Copilot	2025	30% lower mean time to respond	Vendor research
Palo Alto Networks materials	2026	Estimated 20-30% lower firewall-data ingestion cost	Vendor estimate
CrowdStrike Falcon Onum claim	Aug. 31, 2026	Up to 50% lower storage cost from in-pipeline filtering	Vendor claim

Three points stand out from this data. First, the independent analyst rows favor Microsoft and CrowdStrike by name, but we did not verify Splunk’s or Palo Alto’s placements in these exact reports from their own pages, so the table leaves them blank instead of guessing. Second, the four vendor numbers on cost and speed all come from the vendors selling the product, and none is directly comparable, because each measures a different thing (ROI, response time, ingestion cost, storage cost). Third, there is context outside the product claims: CrowdStrike’s 2026 Global Threat Report reported an 89% increase in attacks by AI-enabled adversaries year over year and a fastest eCrime breakout time of 27 seconds in 2025. If attackers move that fast, detection latency and alert triage speed matter more than any ingestion discount.

For a view of how the endpoint platforms beneath these SIEMs rank, our CrowdStrike Falcon vs Cortex XDR vs Defender XDR comparison covers the XDR layer in more detail.

Pricing Models Side by Side

No vendor in this group publishes a flat SIEM price, which is itself a finding. All four sell on ingest, compute or platform commitment, and all four push buyers toward a quote. The table compares the pricing model, the verified entry point and what each vendor says about controlling cost.

Platform	Pricing basis	Verified entry point	Cost-control lever
Splunk Enterprise Security	GB per day, per SVC or activity-based, on top of the platform license	Contact sales, no public price	Cisco telemetry counted at a 50% weighted ingest rate
Microsoft Sentinel	Pay-as-you-go or commitment tiers on analytics ingestion	First 10 GB per day free for 31 days, commitment tiers from 100 GB per day	Limited-time 50 GB commitment-tier promotion
CrowdStrike Falcon Next-Gen SIEM	Ingestion-based, shared across modules with Falcon Flex	10 GB per day free tier for Falcon Insight XDR customers	Falcon Onum filtering, up to 50% storage savings (vendor claim)
Cortex XSIAM	Not published, quote required	Contact Palo Alto Networks	Estimated 20-30% lower firewall-data ingestion cost (vendor estimate)

Two cautions apply. A 10 GB per day entry offer, whether Microsoft’s 31-day trial or CrowdStrike’s free tier, only covers small labs and proof-of-concept work. Most mid-sized organizations ingest well above that, so the commitment-tier structure is what you will actually pay. And dollar figures that circulate in third-party articles often come from older price sheets: historical Sentinel per-gigabyte prices and legacy commitment tiers should not be treated as current without a fresh quote. For one detailed worked example, our Microsoft Sentinel vs Splunk vs Elastic price comparison models several ingest levels.

The practical approach is to ask each vendor to quote the same three workloads: 100 GB per day of mixed log data, 500 GB per day, and a spike scenario that doubles ingest for a week. Compare the totals, the overage behavior and the contract terms for retention. CrowdStrike sells 365-day retention as a named entitlement, so retention length alone can move a quote more than the headline ingest rate does, and you should ask every vendor how retention is priced before you compare totals.

Real-World Examples: What Each Platform Did in October 2026

Vendor behavior under pressure beats spec sheets. The examples below are documented vendor actions from the last several weeks, not hypothetical deployments, and each one shows a different strength.

1. The PHP2Shell response week

Critical PHP flaws CVE-2026-109618 and CVE-2026-109619, reported under the PHP2Shell name, produced the clearest vendor-by-vendor test of the month. Splunk shipped an emergency out-of-band ESCU 6.9.1 for detection and investigation, right after the regular ESCU 6.9.0 release. CrowdStrike added dashboard and correlation-rule coverage through a Falcon Next-Gen SIEM Content Packages update reported from October 23 to 27, and a CrowdStrike partner published a checklist for Falcon customers on what to verify. Palo Alto stated that Cortex XSIAM was not impacted by the vulnerabilities. We identified no Sentinel-specific content release in the window, which does not prove none exists.

2. Federal agencies and CISA SIEMaaS

On October 1, 2026 CrowdStrike announced Falcon Next-Gen SIEM availability through CISA’s SIEMaaS technology stack for eligible federal civilian agencies that use CrowdStrike EDR and participate in the required program. For those agencies, the SIEM question arrived pre-answered with funding attached. CrowdStrike also described the product as delivered through its FedRAMP High-authorized platform in GovCloud, though that detail rests on a single source.

3. Sentinel’s automatic onboarding

Microsoft’s September 9 decision to start auto-onboarding managed Sentinel customers into the Defender portal shows how a vendor-driven migration reaches a customer. The multi-workspace warning is the real lesson: secondary-workspace analytics rules, playbooks and workbooks can stop working if they are not migrated. Any provider managing dozens of tenants should audit those workspaces now.

4. Falcon ingesting Microsoft Defender telemetry

CrowdStrike’s March 23 announcement means an organization running Microsoft Defender for Endpoint can send that data to Falcon Next-Gen SIEM without installing a Falcon sensor. For a Sentinel customer deciding whether to leave, this removes the endpoint rip-and-replace from the first phase. You can move the SIEM and keep the sensor.

5. Palo Alto firewall customers and included log ingestion

Palo Alto said on June 2, 2026 that Enhanced Application Log ingestion would be included at no additional charge for its next-generation firewall and Prisma SASE customers, and its materials estimate 20 to 30 percent lower firewall-data ingestion costs. For a network-heavy estate, that changes which platform wins on total cost, because firewall logs often dominate ingest volume.

6. Splunk’s Cisco telemetry discount

Splunk’s pricing materials count eligible Cisco telemetry at a 50% weighted ingest rate. A Cisco-standardized enterprise with heavy firewall, switch and network visibility data gets a built-in discount that Sentinel and Falcon do not offer in the same form.

7. XSIAM and NVIDIA BlueField

The October 21 XSIAM and NVIDIA DOCA Argus integration sends host-activity signals from BlueField infrastructure to the SIEM. For AI data-center operators, it addresses a visibility gap that standard agents cannot reach.

Use-Case Recommendations

These recommendations combine the facts above with analysis. They assume a mid-sized to large organization and should be tested against your own log volume before you sign anything.

1. Microsoft 365 and Entra-centric organizations: stay on Sentinel and move to the Defender portal. Your telemetry is already there, the free trial lowers risk, and the deadline only affects the console and detection authoring.
2. Cisco-heavy networks with existing Splunk skills: pick Splunk Enterprise Security, especially if you can use the weighted ingest rate on Cisco telemetry. Budget for the platform license plus the ES license, and choose Premier if the Connector Builder Agent matters.
3. Falcon endpoint customers using or considering a non-Falcon sensor: evaluate Falcon Next-Gen SIEM. Its third-party EDR support means you can test it against Defender data without changing sensors.
4. Palo Alto firewall and Prisma SASE estates: get an XSIAM quote, because included firewall log ingestion can shift total cost materially.
5. US federal civilian agencies on CrowdStrike EDR: look at the CISA SIEMaaS path first, since funding is attached.
6. Small teams with limited engineering time: prefer the platform that matches your endpoint vendor, and consider managed options such as the Unit 42 managed XSIAM service or CrowdStrike’s Falcon Complete Next-Gen SIEM upgrade. If budget is the main limit, our Wazuh vs Elastic vs Graylog open-source SIEM comparison shows what a free stack costs in staff time.

One more filter helps when two options tie: the skills already on your team. A group fluent in KQL moves faster on Sentinel, an SPL shop moves faster on Splunk, and a team that has never written a SIEM query will spend its first quarter on training no matter which logo it picks. Price that training time in the comparison, because it is the cost vendors never quote.

Migration Guide: 155 Days to the Sentinel Deadline

The plan below fits the time between late October 2026 and the scheduled retirement of the Azure-portal experience, and it works whether you stay on Sentinel or move. Phases overlap, and the key idea is that the audit in phase one tells you whether leaving is worth it.

Phase 1: inventory and decision (weeks 1 to 4)

1. Export a list of every Sentinel workspace, data connector, analytics rule, automation rule, playbook, workbook and parser. Count them, because the totals drive the cost of a switch.
2. Pull 30 days of ingest by table to find your top five log sources by volume.
3. Check the Defender portal banner and email notices to learn when Microsoft plans to onboard each tenant.
4. Request quotes from the competing vendors for the same three workloads described in the pricing section.

Phase 2: pilot (weeks 5 to 12)

5. If staying, onboard one non-critical workspace to the Defender portal and test roles, incident queues and custom detections. If switching, stand up a parallel pilot and forward a copy of two or three high-volume sources. Microsoft Ignite runs November 17 to 20, 2026, so use it to press for answers on API continuity.
6. Convert ten representative detections. The sample below shows the shape of the work when moving a failed-logon rule from Sentinel’s KQL to Splunk’s SPL.

// Sentinel (KQL): failed Windows logons per account in 5-minute bins
SecurityEvent
| where EventID == 4625
| summarize Failures = count() by Account, bin(TimeGenerated, 5m)
| where Failures > 10

// Splunk (SPL): the same logic
index=wineventlog EventCode=4625
| bin _time span=5m
| stats count AS Failures by Account, _time
| where Failures > 10

Query rewrites are the smallest part of a migration. The cost sits in field mappings, enrichment, suppression logic and tests. CrowdStrike reportedly offers a Query Translation Agent for this job, and Splunk’s Detection Builder Agent gives SPL guidance, but treat any AI translation as a draft and review each rule by hand.

Phase 3: cutover (weeks 13 to 20)

7. Run old and new platforms in parallel for at least 30 days and compare alert counts, mean time to triage and false positives per rule.
8. Move playbooks last. Automation that closes tickets, isolates hosts or disables accounts needs the strictest testing.
9. Reduce retention on the old platform only after legal and compliance sign off.
10. Keep a rollback plan until two weeks after the Azure-portal retirement, and document where each rule now lives.

A warning on platform currency: if your Splunk estate runs Splunk Enterprise 9.3 or earlier, those versions are out of support and are being removed from future ESCU compatibility listings, so a Splunk move needs a version upgrade first. For a different cut of the endpoint question that often drives these SIEM decisions, see our CrowdStrike vs Microsoft Defender vs SentinelOne EDR cost analysis.

Pros and Cons of Each Platform

Splunk Enterprise Security

• Pros: a fast ESCU content track, an agentic SOC direction in 8.7, a Cisco telemetry discount, and deployment on either Splunk Enterprise or Splunk Cloud Platform.
• Cons: two licenses to understand, no public price, some AI features limited to Premier, and older Splunk versions are out of support.

Microsoft Sentinel

• Pros: deep Defender and Microsoft 365 integration, a public free trial, detection-as-code through repositories, and strong analyst standing in IDC and Gartner.
• Cons: a forced move from the Azure portal to the Defender portal, multi-workspace content risk, value that depends on staying in the Microsoft ecosystem, and consumption bills that vary by region and tier.

CrowdStrike Falcon Next-Gen SIEM

• Pros: works with third-party EDR starting with Microsoft Defender, quick content updates after new CVEs, a pipeline filtering approach, and CISA SIEMaaS availability.
• Cons: no public price sheet, the best experience assumes the Falcon platform, and a Visionary placement in the October 2025 Gartner quadrant.

Cortex XSIAM

• Pros: an active release cadence (3.5 in May, 3.6 in July), included firewall log ingestion for Palo Alto customers, a managed option, and infrastructure-level integrations.
• Cons: no public price, strongest value for existing Palo Alto estates, and analyst placements we could not confirm in the reports we checked.

Verdict: Stay, Switch or Split

For most Sentinel customers, the right answer is to stay and complete the Defender portal move. The retirement affects the console, the workspace layout and the detection-authoring method, not the SIEM itself. Leaving means rebuilding every rule, parser and playbook, and that cost dwarfs a portal change unless Sentinel is already a poor fit. With about five months to go, the migration scope for a stay is small enough to finish by the deadline.

Switch only when one of four conditions holds. You are not a Microsoft-centric shop, so Sentinel’s integration advantage is wasted. You run Cisco-heavy infrastructure and can use Splunk’s 50% weighted ingest rate. You already own Falcon and want the SIEM beside it, now that Falcon supports Microsoft Defender data without a Falcon sensor. Or Palo Alto firewall logs dominate your ingest and included enhanced application log ingestion changes the math. If none applies, the deadline alone is not a reason to move.

A split approach is also viable and rarely discussed: keep Sentinel for Microsoft telemetry and send a copy of selected high-value sources to a second platform for 90 days as a proof of value. That costs double ingest for a limited time but gives you real numbers instead of vendor claims. For broader context on tools in this space, browse our cybersecurity coverage.

Your situation	Best fit	Why
Microsoft 365 and Defender estate	Microsoft Sentinel	Native integration, free 31-day trial, portal move only
Cisco-heavy network, Splunk skills	Splunk Enterprise Security	50% weighted ingest on Cisco telemetry, ESCU cadence
Falcon EDR, wants one vendor	CrowdStrike Falcon Next-Gen SIEM	Same platform, plus Defender ingestion option
Palo Alto firewalls and SASE	Cortex XSIAM	Included enhanced firewall application logs
Federal civilian agency on Falcon	Falcon Next-Gen SIEM via CISA SIEMaaS	Funded path since Oct. 1, 2026

Frequently Asked Questions

Is Microsoft Sentinel being discontinued?

No. Microsoft Sentinel remains an active, commercially available product under the same name. Only the Azure-portal experience is scheduled to retire, with the Microsoft Defender portal as the destination.

What does a Splunk SIEM cost?

Splunk does not publish a currency-denominated price for Enterprise Security. Licensing can be by GB per day, per SVC or activity-based, and ES is a premium app that needs a Splunk Enterprise or Splunk Cloud Platform license as well. You need a quote, and the edition (Essentials or Premier) changes which AI features you get.

Can CrowdStrike Falcon Next-Gen SIEM work without Falcon sensors?

Yes, for Microsoft Defender data. CrowdStrike announced that Falcon Next-Gen SIEM supports third-party EDR, starting with Microsoft Defender for Endpoint, without requiring a Falcon sensor.

What is the newest Splunk Enterprise Security release?

Splunkbase lists Enterprise Security 8.7.2 with an October 23, 2026 update date. Release notes document 8.7.1 from October 1 and 8.7.0 from September 2. Security content updates ship separately, and ESCU 6.9.1 arrived October 22.

Which platform responded to the PHP2Shell vulnerabilities?

Splunk released ESCU 6.9.1 on October 22 and CrowdStrike added correlation rules reported around October 23. Palo Alto said XSIAM was not impacted. We found no Sentinel-specific update in the window.

Should I migrate before the Azure-portal retirement or wait for Microsoft to onboard me?

Migrate on your own schedule. Microsoft has been onboarding managed customers since September 9, 2026, and secondary-workspace content can stop working after the move if you have not migrated it. A tested pilot beats a surprise cutover.