Sentinel bills scare people off. Ingestion and tiering decisions let you keep the coverage and defend the invoice.
Microsoft Sentinel is a capable cloud SIEM, and its billing model is the thing that makes people nervous. The good news is that cost is largely a design decision, not an inevitability.
The data you keep, and where you keep it
Not every log needs to sit in the analytics tier. Choosing what to ingest, what to summarise, and what to route to cheaper storage lets you keep detection coverage while keeping the invoice defensible.
- Map connectors to the sources that actually drive detections
- Use the right tier for each data type
- Tune analytics rules so your team sees signal, not noise
Designed together, coverage and cost stop being a trade-off and become a plan you can explain to finance.