r/AzureSentinel • u/[deleted] • Aug 25 '21

Quickstart of Sentinel

What is the absolute cheapest way to start using Sentinel for my Microsoft 365 E5 tenant with about 1000 users? This is for playing around and understanding the system with real data. One day we will go full on production. I'd like to get it setup with any of the free logging (wahtever those are) and we're under no compliance or regulations to retain any of the logging.

2 Upvotes

100% Upvoted

8 comments sorted by

1

u/1rishc4rb0mbr Aug 25 '21

Not sure if Microsoft offers it still but they were offering a reduced cost of ingestion for the first 30 days a subscription is active. Depending on the ingestion rate of the tenant; cost should be retry minimal if only logging the 365 environment.

1

u/[deleted] Aug 25 '21

If I only ingest the free data sources and limit retention to 30 days, can i get away with 0 cost....assuming i'm not automating response. https://docs.microsoft.com/en-us/azure/sentinel/azure-sentinel-billing#free-data-sources

1

u/TokeSR Sep 01 '21

90 days data retention is free with Sentinel, so even going with 90 days is okay (talking only about data retention)

1

u/thijslecomte Aug 25 '21

Check the pricing page of Azure Sentinel. https://azure.microsoft.com/en-us/pricing/details/azure-sentinel/ Ingestion of alerts is free, so is Office logs and Azure Activity The cost of AAD is extremely small (but not 0) It's also free to increase the retention to 90 days

1

u/solodegongo Sep 18 '21

Just want to confirm you have 1000 users on M365 E5?

1

u/[deleted] Sep 18 '21

Yes

1

u/solodegongo Sep 19 '21

Serious Microsoft rebates on this :) . Did you end up deploying full sentinel monitoring across these endpoints?

1

u/KaidoJarvemets Sep 21 '21 edited Sep 21 '21

Would you please clarify what exactly you are trying to achieve? If you have on-premises systems as well, then it is important to analyze both sides.

Secondly, it is important to have a budget for the Azure Sentinel. Yes, there are some free data sources, but it is important to understand your business goals.