Azure Sentinel
A SIEM deployed around one rule: every log source earns its ingestion cost. Detections carry their MITRE technique, playbooks act at 02:00, and the bill has a ceiling with an alarm on it.
MITRE ATT&CK + custom detections
Analytics / Basic / Archive routing
Logic Apps + Sentinel Notebooks
4-6 weeks for tuned baseline
Three prices for the same gigabyte.
Relative costs, illustrative; exact rates vary by region and tier.
Sources detections read every hour: identity, XDR incidents, control plane, mail activity. Full rate, fully earned.
Bulky sources with hunt and compliance value: server events, network flows. Queried on demand through a costed restore workflow.
Logs no detection reads. Where a framework requires copies, cheap storage holds them; a SIEM is a detection tool, priced like one.
The whole engagement is the discipline of putting each source in the lane it earns. The board below is that decision, made playable.
Sentinel fails in exactly three ways.
Last month billed 3x the forecast
Someone enabled a diagnostic setting, a connector defaulted to verbose, and the invoice found out before anyone else did. Here every source enters through a ledger row with a measured GB/day, and an anomaly alert fires the same day a curve bends.
Default rules: overwhelm or miss
Content Hub rules switched on wholesale bury a small team; switched off wholesale they miss the threat model. The delivered set is 50+ rules tuned over a 2-week false-positive baseline, each carrying its MITRE technique and a written tuning reason.
Workbooks built for the demo
Dashboards that impressed in the sales call answer none of the questions an analyst has at 02:00. What ships instead: an incident queue that correlates, playbooks that enrich and act, and runbooks written for the person on call.
You route the sources. The bill follows.
This is the connector cost-value ledger from the delivery kit, made playable: click a lane for any source and watch the monthly bill, the armed rules and the hunt pool re-balance. Try the vendor-defaults preset to see how the 3x invoices happen.
Detections you can read before you buy.
// Password spray followed by a successful sign-in from the same IP.
// MITRE: T1110.003 (Brute Force: Password Spraying)
let window = 1h;
let user_threshold = 8;
let sprayers =
SigninLogs
| where TimeGenerated > ago(window)
| where ResultType in ("50126", "50053")
| where IPAddress !in ((_GetWatchlist("TrustedEgressIPs") | project IPAddress))
| summarize Failures = count(), TargetedUsers = dcount(UserPrincipalName) by IPAddress
| where TargetedUsers >= user_threshold;
SigninLogs
| where TimeGenerated > ago(window)
| where ResultType == "0" // success
| join kind=inner sprayers on IPAddress
| project TimeGenerated, UserPrincipalName, IPAddress, Failures, TargetedUsersOne of three sample rules shipped in the kit; the delivered library is 50+ Content Hub rules tuned per estate plus custom KQL for your threat model.
No rule pages anyone before validation: simulation, replay of a past incident, or a red-team reference, recorded per rule in the detection catalog. On the Sovereign tier the whole library lives as code, deployed through pull requests with provenance an auditor can walk.
The other two samples in the kit: an inbox-rule exfiltration detection (T1114.003) and a baseline-aware rare-admin-operation rule (T1078.004). Ask for any of them on the discovery call.
Scoped in writing, bounded in writing.
In scope
- Workspace deployment + connector strategy
- 50+ MITRE-mapped analytics rules
- Cost guardrails + budget alerts
- Top 5 automation playbooks
- Operational handover with on-call matrix
Deliberately out of scope
- 24/7 SOC monitoring (we integrate with your chosen MDR / SOC partner)
- Custom data connector development (case-by-case)
- Threat intelligence feed procurement
- Sentinel for SAP add-on (separate scope)
The delivery kit, folder by folder.
Bracketed fields get filled during delivery, in your repository.
Estate, sources, threat model, budget: the week-1 intake.
Data-source strategy + cost guardrails, decided in writing.
Every source scored: GB/day, lane, cost, and who reads it.
Catalog template + three sample KQL rules, inspectable now.
Ten procedures: onboarding, cost spikes, tuning, hunts, MDR.
Everything you own, access enumerated, successor handover.
11 controls mapped to DORA, NIS2, GDPR and ISO 27001.
Essential / Operate / Sovereign, signed during discovery.
The monthly SIEM review: cost vs value, drift, coverage.
Build it on a budget. Keep it on a rhythm.
Each tier carries its delivery arc inside it: ledger and threat model first, deploy and tune against a measured baseline next, then the monthly review or a documented hand-off. The scope sheet gets signed during discovery.
Essential
A tuned baseline that respects the budget it was given.
- Weeks 1-2: connector ledger scored, threat-model workshop, budget set
- Workspace + top 5 connectors with cost-value justification
- 50+ analytics rules tuned over a 2-week false-positive baseline
- Top 3 automation playbooks + daily-cap guardrails armed
- Runbook library + 30-day support window
Outcome
A SIEM your team trusts and your CFO can read, with every source justified in writing.
Operate
The monthly rhythm that keeps signal up and spend flat.
- Everything in Essential
- Up to 15 connectors under continuous cost optimisation
- Monthly SIEM review: cost vs value, rule drift, workspace health
- Quarterly MITRE coverage gap analysis
- MDR / SOC integration with an annual escalation drill
Outcome
Detections that keep matching reality, and a bill that stops being a monthly surprise.
Sovereign
Detection-as-code and hunting for regulated estates.
- Everything in Operate
- Detection-as-code pipeline: repo, PR governance, API deploys
- Custom threat hunting on emerging actors, with artifacts filed
- UEBA configuration + insider-threat detections
- Audit-grade rule provenance + tabletop exercises
Outcome
A SIEM whose every rule has provenance, and a hunt programme that leaves evidence.
Honest answers to the questions buyers actually ask.
How do you control Sentinel ingestion costs?
+
Per-connector cost-value scoring, archive-tier routing for low-fidelity sources, daily-cap alerts, and a documented budget guardrail. We do not ingest data we cannot justify against a specific detection.
Sentinel or a third-party SIEM (Splunk, Elastic, Chronicle)?
+
Sentinel wins for Microsoft-heavy estates (E5 license advantages + native MDE/MDI/MDO ingestion). Splunk wins for very high-volume bespoke ingestion. Chronicle wins for Google-heavy estates. We pick based on data gravity, not vendor brochures.
Can you integrate with our existing SOC?
+
Yes. We design Sentinel to be operable by an external SOC / MDR partner. Runbooks, rule documentation, and the escalation matrix are part of the handover. ITSailor is not a 24/7 SOC.
Our Sentinel bill already exploded. Can you fix it without a rebuild?
+
Yes, and it is a common entry point. The ledger discipline applies to an existing workspace: measure per-table volume from the Usage table, score every source against the rules that actually read it, move the bulky-but-valuable middle to Basic and Archive lanes, filter noise at ingest with transformation rules, and arm the guardrails. Savings are measured against your own last three invoices, never estimated.
Do we lose detections when logs leave the hot lane?
+
The trade is real and it is made explicitly, never silently. Real-time rules need hot data; rules whose sources move to Archive become hunt queries, run on demand through a costed restore workflow. The detection catalog records which MITRE techniques ride each lane, so the coverage decision is a signed document instead of a surprise during an incident.
Defender XDR or Sentinel first?
+
For an M365-centric estate: Defender first, and its incidents connector into Sentinel is free ingestion. Sentinel earns its keep when sources beyond Microsoft 365 matter: firewalls, SaaS audit logs, custom applications, multi-cloud. The Defender service page covers the XDR layer; the two are designed to meet in one incident queue.
Who watches it at night?
+
Your team or your MDR partner, by design. ITSailor is not a 24/7 SOC: we build the workspace, the rules and the runbooks so an external operator can run them, we wire the escalation matrix, and we drill the hand-off. You own the MDR relationship; we keep the detection engineering honest underneath it.
The SIEM is the tower. The stack is the ground.
Microsoft 365 Defender
The XDR layer whose incidents flow into Sentinel through the free connector.
OpenAzure Cloud Infrastructure
The landing zone whose Log Analytics foundation this SIEM builds on.
OpenZero Trust Security
The architecture narrative around detection: verify explicitly, assume breach.
OpenDecide what the workspace is allowed to ingest before the bill decides for you.
Connector scope, retention tier and detection coverage are one decision. The workshop takes them together, against the estate you actually run.