Microsoft SentinelvTines
Microsoft Sentinel 6.21Tines 6.42
Microsoft Sentinel v Tines: the totals are 0.21 apart, inside the 0.25 band. They are a band, not a ladder, so read the rows that decide the pair. Rows won: Microsoft Sentinel 4, Tines 4, level 1.
The difference that decides Microsoft Sentinel v Tines
On documented AI features, Tines runs agents inside stories and an AI SOC for intake, triage and remediation (vendor claim, score 7.0), while Microsoft Sentinel had no AI features in the pages scored on 2026-11-03 (score 4.0). tines.com, read 2026-11-03
Rows with the widest weighted gap: Agentic or AI features that are documented (Tines ahead by 3.0), Case management and collaboration (Microsoft Sentinel ahead by 3.0), Ownership stability (Tines ahead by 2.0).
Microsoft Sentinel v Tines: the nine rows side by side
Playbook authoring model
weight 14 of 100Microsoft Sentinel
8.5Ahead
Playbooks are Azure Logic Apps built in the Logic App designer, with Azure Functions for code, conditional controls and ARM template export for portability.
learn.microsoft.com, read 2026-11-03; learn.microsoft.com, read 2026-11-03
Integration count and depth documented
weight 14 of 100Microsoft Sentinel
6.0Ahead
Logic Apps connectors, Content hub solutions, a playbook templates tab and GitHub samples. No connector count read.
learn.microsoft.com, read 2026-11-03
Tines
5.0
No integration count on the home page; positioned as vendor-agnostic. HTTP-based actions reach any API (not read on a docs page).
tines.com, read 2026-11-03
Case management and collaboration
weight 8 of 100Microsoft Sentinel
7.0Ahead
Incidents group alerts by entity and severity; automation rules create analyst task lists; Defender portal changes alter incident behaviour.
learn.microsoft.com, read 2026-11-03; learn.microsoft.com, read 2026-11-03
Approvals and human-in-the-loop controls
weight 12 of 100Microsoft Sentinel
7.0
Microsoft's guidance says high-impact automations should have human input; 'Send approval email' maps to Splunk prompts. Approval is built by the author, not a built-in gate.
learn.microsoft.com, read 2026-11-03
Tines
7.0
Home page states governance, guardrails and monitoring, and that you choose where and when models are used. Coverage of the January 2026 AI interaction layer cites human-in-the-loop controls and audit logging (search summary).
tines.com, read 2026-11-03 (vendor claim) (search summary only); tines.com, read 2026-11-03 (vendor claim) (search summary only)
Agentic or AI features that are documented
weight 12 of 100Microsoft Sentinel
4.0
Not found in the pages read on 2026-11-03. Security Copilot features were not read.
learn.microsoft.com, read 2026-11-03
Hosting and data residency options
weight 8 of 100Microsoft Sentinel
5.0
Azure only; Hybrid Runbook Worker reaches on-prem systems. Data residency not read.
learn.microsoft.com, read 2026-11-03
Pricing model and transparency
weight 8 of 100Microsoft Sentinel
4.0
Not found in the pages read on 2026-11-03. Logic Apps billing not read.
learn.microsoft.com, read 2026-11-03
Tines
6.0Ahead
A free edition (3 live workflows, one-time USD 50 AI allowance) is published; paid editions are by request with no pricing unit.
tines.com, read 2026-11-03
Migration tooling and import or export formats
weight 14 of 100Microsoft Sentinel
7.0Ahead
Microsoft publishes a concept map from Splunk SOAR (and QRadar SOAR) to automation rules and Logic Apps, updated 2026-08-12. It names no converter tool.
learn.microsoft.com, read 2026-11-03
Tines
6.0
Tines' help article, read 2026-11-03, names the format: stories export as JSON with credentials, resources and event data excluded and import with a Replace option, while the docs page itself does not name the format, no inbound SOAR converter was found, and a library story moves Splunk SOAR case records, not logic.
explained.tines.com, read 2026-11-03; tines.com, read 2026-11-03
Ownership stability
weight 10 of 100Microsoft Sentinel
6.0
After 2027-03-31 Sentinel is supported only in the Defender portal; Microsoft documents automation differences: 5 to 10 minute batching of incident updates, up to 10 minutes before automation rules run, and playbook manual runs not yet supported in Defender.
learn.microsoft.com, read 2026-11-03
Tines
8.0Ahead
Independent; USD 125M round led by Goldman Sachs Alternatives in February 2025 at about USD 1.13B. Product naming changed in 2026 (Tines Stories and 3B).
pymnts.com, read 2026-11-03 (search summary only); tines.com, read 2026-11-03 (search summary only)
The verdict for Microsoft Sentinel v Tines, by buyer type
- Microsoft shop
- Microsoft Sentinel fits better, because it runs playbooks as Azure Logic Apps with ARM export, and Microsoft's own Splunk SOAR concept map was updated 2026-08-12; Tines documents nothing for this buyer type on the pages read.
- small team
- Tines fits better, because it publishes a free edition with 3 live workflows and a one-time 50 USD AI allowance; Microsoft Sentinel publishes pay-as-you-go pricing, with Logic Apps charges added for playbooks.
- agent-first
- Tines fits better, because it runs agents inside stories and an AI SOC for triage and remediation (vendor claim); Microsoft Sentinel had no AI features in the pages scored on 2026-11-03.
When to pick each
Pick Microsoft Sentinel when
Pick Microsoft Sentinel when you are a Microsoft shop and you want a tool that runs playbooks as Azure Logic Apps with ARM export, and Microsoft's own Splunk SOAR concept map was updated 2026-08-12.
Pick Tines when
Pick Tines when you are agent-first and you want a tool that runs agents inside stories and an AI SOC for triage and remediation (vendor claim).
Moving playbooks between Microsoft Sentinel and Tines
The portability matrix records seven playbook types for each direction it covers. Verdicts are documentation findings, not test results. How the matrix is built.
| Playbook type | Verdict | Reason |
|---|---|---|
| Enrichment lookups | rebuild from scratch | Tines' legacy SOAR migration post (read via a third-party summary) names no source platform or converter, so no documented path on 2026-11-03. tines.com, read 2026-11-03 |
| Phishing triage | rebuild from scratch | Tines' legacy SOAR migration post (read via a third-party summary) names no source platform or converter, so no documented path on 2026-11-03. tines.com, read 2026-11-03 |
| Endpoint containment | rebuild from scratch | Tines' legacy SOAR migration post (read via a third-party summary) names no source platform or converter, so no documented path on 2026-11-03. tines.com, read 2026-11-03 |
| Identity actions | rebuild from scratch | Tines' legacy SOAR migration post (read via a third-party summary) names no source platform or converter, so no documented path on 2026-11-03. tines.com, read 2026-11-03 |
| Ticketing and case sync | rebuild from scratch | Tines' legacy SOAR migration post (read via a third-party summary) names no source platform or converter, so no documented path on 2026-11-03. tines.com, read 2026-11-03 |
| Custom scripted logic | rebuild from scratch | Tines' legacy SOAR migration post (read via a third-party summary) names no source platform or converter, so no documented path on 2026-11-03. tines.com, read 2026-11-03 |
| Scheduled or batch jobs | rebuild from scratch | Tines' legacy SOAR migration post (read via a third-party summary) names no source platform or converter, so no documented path on 2026-11-03. tines.com, read 2026-11-03 |
| Playbook type | Verdict | Reason |
|---|---|---|
| Enrichment lookups | rebuild from scratch | Tines documents story JSON, but no importer for it or migration guide was found for Microsoft Sentinel automation, so no documented path on 2026-11-03. tines.com, read 2026-11-03 |
| Phishing triage | rebuild from scratch | Tines documents story JSON, but no importer for it or migration guide was found for Microsoft Sentinel automation, so no documented path on 2026-11-03. tines.com, read 2026-11-03 |
| Endpoint containment | rebuild from scratch | Tines documents story JSON, but no importer for it or migration guide was found for Microsoft Sentinel automation, so no documented path on 2026-11-03. tines.com, read 2026-11-03 |
| Identity actions | rebuild from scratch | Tines documents story JSON, but no importer for it or migration guide was found for Microsoft Sentinel automation, so no documented path on 2026-11-03. tines.com, read 2026-11-03 |
| Ticketing and case sync | rebuild from scratch | Tines documents story JSON, but no importer for it or migration guide was found for Microsoft Sentinel automation, so no documented path on 2026-11-03. tines.com, read 2026-11-03 |
| Custom scripted logic | rebuild from scratch | Tines custom logic is Python Run script action, but Microsoft Sentinel automation documents no importer for it, so no documented path on 2026-11-03. tines.com, read 2026-11-03 |
| Scheduled or batch jobs | rebuild from scratch | Tines documents story JSON, but no importer for it or migration guide was found for Microsoft Sentinel automation, so no documented path on 2026-11-03. tines.com, read 2026-11-03 |
Profiles
Microsoft Sentinel. Tines. Alternatives: instead of Microsoft Sentinel, instead of Tines.