Microsoft is doing a surprisingly good job with their Sentinel SIEM. The sweetener is they give you free ingestion on most of your Office 365/Azure logs which can add up if you’re shipping out to another platform.

Makes it attractive for enterprises already on their platform and they throw in discounts for E5 license tier customers as well (gotta keep pushing the “give us everything or pay way more for single feature licenses”).