What you runRunning Microsoft Sentinel?
Verbose logs pay the same rate as the ones that catch attackers.
Sentinel is the cloud-native SIEM that works: KQL is a serious language, and for Microsoft-heavy estates the Defender integration is hard to argue with. The pressure is what reaches the workspace: every GB entering the Analytics tier bills at one rate, signal or noise.
Free. No system access. No obligation. You keep the drawing.
Step oneA pipeline in front of your SIEM, designed and built by Logmetry. Your SIEM stays. A full raw copy stays in your own account.
At least 20% less into your SIEM, every alert kept, proved on your data.
Microsoft Sentinel SIEM
$129 per GB/day a month
To ingest 1 GB every day for a month, at list price.
Commitment tiers from 100 GB a day lower the rate.
Microsoft Sentinel pricing page, checked 2026-09-24
01The four problems
Which of these hits your Microsoft Sentinel estate?
Budget, renewals, the order to bring in AI, and collection that runs on someone else’s agents. Each one is about where the data lives, and with Microsoft Sentinel it lives in Microsoft Sentinel’s ecosystem. Pick yours.
“Our Sentinel bill grows every month, and so does the noise.”
Pay the Analytics tier for signal. Everything else lands in your Lake.
- Why it happens
Sentinel bills every GB entering the Analytics tier. Verbose operational data lands beside the security events, at the same rate.
- What changes
Data is tiered before it reaches Log Analytics. Security signal keeps the Analytics tier, and the rest lands in a Lake you own, replayable on demand.
- How sure you can be
Nothing is lost. The full copy stays in your Lake and replays on demand, and every routing rule is readable code. The reduction is measured on your own noisiest sources, before and after, in writing.
- How soon
With the first source. We start where the most volume sits, prove it, then continue.
- What it takes from you
Your diagrams and one call to start. We build it as code in your repositories and teach your team to run it.
What shrinks
- GB indexed by your SIEMOnly what detection reads is indexed. Duplicates, debug output and unread fields stay out.
- Tokens per AI investigationEvery query to the Lake returns only the fields the agent needs.
- Hosts on per-node licensesOrdinary hosts move to monitoring you own. The APM keeps the apps that earn it.
- Vendor licenses and modulesYou keep the features that earn their price, not the whole platform.
Shapes, not figures. Yours are measured on your own sources in the review.
“Every Microsoft agreement bundles a little more of our security into one vendor.”
Keep Sentinel for what it does best. Keep the choice for everything else.
- Why it happens
Agents, connectors, the workspace, KQL and now the AI sit in one agreement. Each bundle makes the next one harder to question.
- What changes
Collection, normalization and history live in your account. Sentinel stays your SIEM, and the data it does not need is never locked into its workspace.
- How sure you can be
The detections, dashboards and alerts your team relies on keep firing where they do today. A move becomes a parallel run on the same routed feed, proven before anything is retired.
- How soon
Before your next renewal, if we start with the sources that drive it.
- What it takes from you
Your diagrams, your renewal date, and one call.
Your way out
- MigrationToday: Quarters of overlapping licensesWith you in control: Weeks: a parallel run, then a routing change
- Your dataToday: Their format, in their storeWith you in control: Open schemas, OCSF and OpenTelemetry, in your Lake
- HistoryToday: Stays behind when you leaveWith you in control: Replays into any tool you choose
- Collection and fleetToday: Their agents, their consoleWith you in control: A control layer and fleet plane you own
“We’re told to use AI in the SOC, and the answer is one more Microsoft product.”
Your agents, on your data, following your runbooks. Not one more module on their price list.
- Why it happens
Microsoft’s AI reads what you paid to ingest into the workspace, sold as one more line on the agreement. It is their AI, on their rules and their runbooks, never yours.
- What changes
We trim every event in flight to only the fields an agent needs and land it in your Lake. Your agent runs in your account on models you choose, follows entities into that full history, and works every Sentinel incident.
- How sure you can be
Agents reason well on clean, trimmed data and badly on noise. Knowing which fields matter takes understanding machine data, source by source, and that is the work we do.
- How soon
As soon as the first sources land clean in your Lake, your agent has something worth reading.
- What it takes from you
Your runbooks, or we write them with you. The agents, prompts and runbooks are code you own.
What you get running
- Agents you control, in your accountThey run where your data is, under your access rules.
- Models you choose, and swapSmall or open-weight models for routine alerts, larger ones for investigations. Changing one is a config change, not a renewal.
- Your runbooks, as codeVersioned in your repositories. The agent follows them step by step.
- Token controlFields trimmed in flight to what the agent needs, so every query reads less and costs less.
- Fixes as pull requestsThe agent writes the fix, a person approves it, and remediation moves at the speed of a review.
- A Lake anyone can queryDevelopers and stakeholders ask the clean Lake directly, at object-storage prices.
“We want one standard for collection, not an agent for every product.”
LaterA later step, sold only after step one is proved on your data.
Open collection you own. Sentinel becomes one destination.
- Why it happens
The Azure Monitor Agent and data collection rules speak Azure first, so collection is where the lock-in starts.
- What changes
The logs work lands first. Open collection on OpenTelemetry follows, routed to Sentinel and anywhere else.
- How sure you can be
OpenTelemetry is the open standard the major APM vendors already accept. Nothing about your destinations has to change on day one.
- How soon
Later. We start with the logs in front of your SIEM, because that is where the money is. Open collection follows once that is proved, host group by host group.
- What it takes from you
Your diagrams and one call. We plan the order with you.
Your control plane
- OpenTelemetry collectorsOpenOne open collector on every host, built for your estate.
- A fleet plane you ownYoursConfiguration and rollout from a console in your account, under OpAMP.
- Changes as pull requestsAs codeAI native: an assistant drafts the change, your team reviews and merges it.
- No vendor agentsRemovedNothing on a host reports to someone else’s console.
- Monitoring, only what earns itYour callStep away from a vendor’s full architecture and keep only the features you value.
02Today, and after
Today, and with the Blueprint
A Sentinel estate is billed per GB as data enters Log Analytics, verbose operational data at the same rate as security signal, with parsing pushed into every analytic rule.
Scroll the drawing sideways to see all of it.
What Microsoft Sentinel does best
Sentinel is the cloud-native consolidation play that actually works: KQL is a serious analytics language, the Defender integration means endpoint, identity, and email signals arrive already correlated, and for Microsoft-heavy estates the operational fit is hard to argue with. Commitment tiers reward predictable volume with real discounts.
The friction is what reaches Log Analytics and in what shape. Inconsistent field names across firewalls, identity providers, and endpoints mean every analytic rule carries its own parsing logic, and billed volume climbs when verbose operational data lands in the Analytics tier beside the security events that belong there.
How it works, and where we sit
Microsoft Sentinel is the cloud-native SIEM built on a Log Analytics workspace: the Azure Monitor Agent and data connectors feed it through data collection rules, and detections are analytics rules written in KQL over the ASIM normalized schema. It is billed per GB as data enters the workspace, at pay-as-you-go rates or commitment tiers that reserve daily volume at a discount. We tier data before it reaches Log Analytics, normalize to ASIM upstream, and keep the full-fidelity history in a Lake beside it.
03The five verbs
What we keep, and what changes
Keep it and govern what flows in, shrink its footprint, cut what it costs, extend it with an agent, and replace only where replacement is honest.
- Keep
The workspace, the analytics rules, and the Defender integration. Sentinel stays your SIEM, your team keeps working in it, and every KQL detection keeps firing on the same inputs it fires on today.
- Shrink
Verbose operational data tiers to lower-cost paths before it reaches Log Analytics, while high-value security events keep the Analytics tier.
- Cut
Billed volume drops while detections keep their inputs, and the commitment tier gets right-sized against what actually flows into the workspace rather than against what the estate happens to produce.
- Extend
An agent you own works Sentinel incidents, following entities into full-fidelity history the workspace never held.
- Replace
Never. The control layer sits in front of Sentinel, and the Lake beside it, so the workspace does what it is best at on the data that earns its tier.
The letters mark where each verb acts in the drawing with the Blueprint.
ASIM upstream, the Lake beside
Normalizing to the ASIM schema upstream means firewall, identity, and endpoint events arrive in consistent fields, which keeps analytic rules simple across a large estate.
Migrations onto Sentinel stall when detections, parsers, and data sources are rebuilt by hand against an unfamiliar schema. We run the old SIEM and Sentinel in parallel against the same routed feed, so detections are validated firing in Sentinel before anything is retired.
Full-fidelity copies land in object storage you own, so cheaper Sentinel tiers never mean losing access to raw history, and the next platform decision, whenever it comes, is a routing change.
04The free architecture review
We draw your Microsoft Sentinel estate, free.
Telemetry engineers look at your whole environment and show you exactly where the cost, the waste and the hurdles are, and what your architecture could look like. No strings attached.
What you get
- Your Microsoft Sentinel architecture today, drawnEvery source, pipeline and destination, as it actually flows.
- The waste mapWhere you pay for data nobody reads, and what it costs you each year.
- Costs before and after, with estimatesWhat you spend now, and what the same coverage would cost.
- Your target architectureWhat your Microsoft Sentinel estate could look like, drawn on your own sources.
- Options for your business problemNot one product. The choices, with what each one costs and changes.
Who does it
A lead architect with 26 years in monitoring and observability, leading a team of senior engineers in telemetry engineering and pipeline design. The team that reviews it is the team that would build it.
What it takes from you
Your diagrams and one call. No system access.
What comes next
If it pays, a two-week proof of value on your noisiest source, free unless you go ahead. At least 20% less into your SIEM, every alert kept, proved on your data.
What it costs
Nothing
No strings attached. You keep the drawing, whatever you decide.
05Questions
What Microsoft Sentinel teams ask before they book
How do you control Sentinel ingestion cost without losing detections?
Tier data before it reaches Log Analytics. High-value security events go to the Analytics tier, verbose operational data to lower-cost paths, and full-fidelity copies to storage you own. The billed volume drops while every detection keeps its inputs.
Can you migrate us from Splunk to Sentinel?
Yes, as a parallel run rather than a leap. Both platforms receive the same routed feed while detections are rebuilt and validated in Sentinel, and the cutover is a routing percentage rather than a weekend. The dual license window shrinks to the time the proof takes.
Does the Lake compete with Sentinel?
No. The Lake holds what the workspace should not have to: full-fidelity history at object-storage cost, replayable into Sentinel on demand. The workspace does detection on the data that earns its tier. Each does the job it is priced for.
Why is the review free?
Because the drawing is how you judge us. You see your own architecture, your waste and your options before you spend anything, and you keep the drawing whatever you decide. No system access, no obligation.
Are you a reseller for a vendor?
Yes, for certain vendors’ software. We are also the delivery partner and integrator on custom projects, directly or alongside your systems integrator. The pipeline subscription is in your name, bought from the vendor, its channel or through Logmetry where we resell it, and priced on its own line. We recommend what fits your business problem, even when that means changing nothing, and no SIEM or APM vendor pays us to recommend it.
What if the savings don’t hold on our data?
You see it measured before you commit. The two-week proof of value runs on your noisiest source, with success criteria signed before it starts, measured in your SIEM’s own license usage view. At least 20% less into your SIEM, every alert kept, proved on your data.
See your Microsoft Sentinel estate drawn, with the costs, before you spend anything
Run by a lead architect with 26 years in monitoring and observability. No system access, no charge, no obligation.
Free. No system access. No obligation. You keep the drawing.
What you get
- Your architecture today, drawn
- The waste map
- Costs before and after, with estimates
- Your target architecture
- Options for your business problem
What it costsNothing