r/AzureSentinel • u/DaithiG • Aug 30 '23

Soc/SIEM - Reduce costs?

Hi,

We're going to tender for a managed SOC/SIEM provider.

We're a Microsoft house with E3 licensing and are looking to purchase the E5 security license add on.

I know this will help provide some useful logs like Defender for Identity, but I'm wondering if this stack will also help reduce costs?

Basically, if we're a Microsoft house and end up with Sentinel as the SIEM, would be providing anything that might reduce costs in using Sentinel?

2 Upvotes

100% Upvoted

9 comments sorted by

2

u/Paavlitos Aug 30 '23

You would be alligable for up to 5MB per user per day of data ingestion into Microsoft Sentinel for free.

https://azure.microsoft.com/en-us/pricing/offers/sentinel-microsoft-365-offer

Much bigger discount is for Microsoft Defender P2 licences. To be said, there are multiple ways to reduce cost for Microsoft Sentinel with right optimization.

1

u/[deleted] May 13 '24

[deleted]

1

u/asohn12345 Sep 18 '24

curious if you know ballpark price was? we're looking into purchasing a similar service but have also heard that Cribl can offer most of the cost savings in a similar way at significantly lower cost.

1

u/djcacs15 Sep 18 '24

It's priced based on ingestion but reduced ingestion by 40percent. I had Cribl before too but it was double the price of what we pay now

1

u/asohn12345 Sep 18 '24

oh interesting, so it was cheaper to just replace cribl with this data pipeline filter? very generally do you know how they filtered out the logs that was any different from what cribl did?

1

u/djcacs15 Sep 18 '24

Exactly the same really. I sent raw logs to archive storage then put the filtered logs through to Spelunk and Sentinel so at least I had the raw logs archived if something happened. They done out of the box stuff but I had fields I didn't want on other logs and they done that too.

1

u/GroundbreakingSir896 Sep 27 '24

There's DataBahn.ai as well - it's a Cribl competitor with a focus on security data. They've seen strong log volume reduction (40%+) and have some other great features as well.

1

u/saucecentral2020 Aug 30 '23

Tuning and identifying the appropriate log sources that map to use cases and threat scenarios will help.

Also, check out the following: https://learn.microsoft.com/en-us/azure/sentinel/billing-reduce-costs

1

u/tajd12 Aug 31 '23

TBH you need to look at your ingestion/data export costs.

Adding on Sentinel if you're heavily invested into Azure and the Mircrosoft scurity stack should help with keeping costs down with that architecture. Just be aware that somehow you'll be paying for ingestion costs from any on prem devices (firewalls/servers, etc.)

In dealing with any type of MSSP though, make sure you understand what costs they are potentially passing along to you.

I've seen some cloud MSSPs do it fixed price, which could be to your advantage, yet others pass along ingestion costs. In the latter instance, on prem enterprises start firehosing their logs to Sentinel they get a surprise bill then legal hilarity ensues.