Open source Microsoft Sentinel alternatives
Every project in the catalog is MIT, Apache or BSD licensed. 0 projects explicitly describe themselves as a Microsoft Sentinel alternative; 6 more are in the category where Microsoft Sentinel is a typical product.
Open source projects in the same category: SIEM & Security Monitoring
Category-level information: these projects are the same kind of software as Microsoft Sentinel; they have not claimed to be a one-to-one replacement.
Prowler
100prowler-cloud · SIEM & Security Monitoring
Common commercial products in this category: Splunk Enterprise Security, IBM QRadar, Microsoft Sentinel
- You automatically scan vulnerabilities in your cloud infrastructure with ready-made audit controls.
- Report the availability of your system according to different industry standards and compliance frameworks.
- Using cloud inventory data, you visualize critical security findings and possible attack paths.
- • High number of open issues (525)
- • NeutralHacker News
College Prowler Caught Using Fake Facebook Accounts + Groups to Build List
“This headline really threw me, as it sounds like some kind of sexual predator was using social media tools to research victims or something. Or am I the only one who read it like that? The reality is that a company called "College Prowler" was using Facebook for guerrilla…”
OpenCTI
90OpenCTI-Platform · SIEM & Security Monitoring
Common commercial products in this category: Splunk Enterprise Security, IBM QRadar, Microsoft Sentinel
- You configure and store technical and non-technical information on cyber threats according to STIX2 standards.
- By analyzing the relationships between the data, you make new inferences from existing information.
- By transferring data in different formats, you integrate the platform with tools like MISP and MITRE ATT&CK.
- • High number of open issues (2,265)
Falco
100falcosecurity · SIEM & Security Monitoring
Common commercial products in this category: Splunk Enterprise Security, IBM QRadar, Microsoft Sentinel
- You observe events such as system calls based on special rules
- You enrich events with container runtime and Kubernetes metadata
- Analyze collected events in SIEM or data lake systems
- ↓ NegativeGitHub Issue
OOM on physical servers
“**Describe the bug** Pn 0.34.x releases we do experience mem leak on physical instances, while the same setup on AWS is fine. It could be due node workload, but still its clear mem leak. Actually as of now RC not identified, - looking for help to do some mem profile or debug the…”
- • NeutralGitHub Issue
Falco on GKE - dropped syscall events
“**What happened**: Falco is constantly dropping events on a really small GKE cluster (3 nodes) and 9 containers (excluding Google services containers) **What you expected to happen**: I would expect that for a cluster of such size that falco would have no issues handling the…”
Zeek
100zeek · SIEM & Security Monitoring
Common commercial products in this category: Splunk Enterprise Security, IBM QRadar, Microsoft Sentinel
- You perform detailed traffic analysis by resolving network protocols in the application layer.
- By writing your own scripts, you customize network monitoring policies to their needs.
- In high-performance networks, you archive network activities by tracking application layer states.
- ↑ PositiveHacker News
Zeek is now a component of Microsoft Windows
“I think the real issue here is that things like Snort, Suricata, and Zeek are just not very popular as a class of security thingy anymore. Certainly, for the last 10 years or so, I'd have advised most startups I worked with against deploying anything like them. There was, in the…”
- ↓ NegativeHacker News
Zeek is now a component of Microsoft Windows
“> Corelight, the leader in open network detection and response (NDR), today announced the integration of Zeek®, the world’s most popular open source network security monitoring platform,... How not to write an opener of your press release. From "the leader", to (r), to "world's…”
beenuar · SIEM & Security Monitoring
Common commercial products in this category: Splunk Enterprise Security, IBM QRadar, Microsoft Sentinel
- It collects telemetry data from security vehicles and correlates with rule-based threat detection.
- Using AI agents, you study events and view decisions and motives in a way that is auditable.
- With the new threat intelligence data, you re-examine the data collected in the past and provide human approval for the proposed actions.
OpenBAS
84OpenEx-Platform · SIEM & Security Monitoring
Common commercial products in this category: Splunk Enterprise Security, IBM QRadar, Microsoft Sentinel
- You plan and manage corporate cyberattack simulation campaigns.
- Using OpenCTI data, you analyze the organization's vulnerabilities.
- You run simulation injections through different channels, such as email, SMS, and alarm systems.
- • Website is unreachable (checked: 2026-10-31)