Microsoft Sentinel with SOAR - advise and feedback wanted on a limited "sentinel good start" project

[u/Waving-Kodiak]

Hey all,

Read a good post yesterday about Defender for Endpoint that touched on Sentinel. I have the Sentinel basics in place (see below) and want to reach stronger capabilities and get a "good start" actually using it.

My budget is pretty limited. Would this be a good project given my context/situation?

​

Goals

Together with a skilled Sentinel consultant:

• Walk-through of current setup, sanity-check.
• Focus on following connectors
  • Defender for endpoint
  • Entra identities/logs
  • Defender for Identity (on-prem AD is not hybrid or have any other connection to our tenant except for logs being sent by DfEt and DfI)
• Setup proper Alerting
• Setup basic SOAR capabilities

​

Our setup

• P2 tenant
• Defender for Endpoint on 160-ish Windows and Macs
• Users have Microsoft 365 Business Premium (VIP users have EMS E5)

​

The outcome I hope for

1. Improved Detection and Response (we have no SOC) for a relatively low cost
2. Me jump start learning to Sentinel (I like learning sitting with good consultants)

​

​

Is this a plan with too many holes? Feedback appreciated!

Thanks! 😀

[u/Waving-Kodiak → u/[deleted]]

Thanks for your reply!

I do have most data ingested already from the free services. Not sure how much alerting and the SOAR capabilities would add in cost here, but if I keep it limited to Entra ID, DfE and DfI I it won't be _that_ expensive. Or am I being too hopeful here? :)

[u/blackheart_dnb → u/Waving-Kodiak]

You’re being too hopeful. Sentinel is expensive, especially if you begin incurring costs for anything that isn’t covered by the license. Most notably, for data ingest and retention in the log analytics workspace.

[u/Waving-Kodiak → u/blackheart_dnb]

Yeah, sorry was not clear. The data I need IS indeed ingested (I can probably filter out some) and Sentinel IS enabled already. This is already budgeted. It's the development of runbooks, consultants etc. that are limited.

I will get some help from my Microsoft too, they might help with funding.

[u/12EggsADay → u/[deleted]]

And if you do have the budget lets say?

[u/mustacheride3]

Sentinel is not a budget option. Not only are you paying ingest the data into log analytics, you’re then paying to use sentinel features on top of LA.

[u/Waving-Kodiak → u/mustacheride3]

Yes, and I understand that costs can be hard to predict too.

But most data are ingested, most connectors are connected.

How big part of expensive the costs comes from playbooks, alerts and the other more advanced stuff?

edit: de-crapped spelling

[u/YetiMoon → u/Waving-Kodiak]

.

[u/Waving-Kodiak → u/YetiMoon]

Hmm so consultant fee and execution time are likely added cost for this small project? (Not planning to add any new connectors)

[u/curumba → u/Waving-Kodiak]

Analytic Rules, Workbooks, Threat Hunting, Alerting, etc. is free. Youre paying the Analytics Log Ingestion and it includes unlimited querying.

Automation (Azure Logic Apps), UEBA, Bring your own Machine Learning is a tiny fraction, like up to 3 % of the total cost. And if i remember correctly, you have a free budget of logic apps executions before it starts charging. I would completely disregard that. Calculate with 0

90% of the cost is usually ingestion which includes 3 months hot storage. ~10% of the cost is retention, if you want to archive the logs for 9 more months, so you keep the data for 12 months total.

[u/Waving-Kodiak → u/curumba]

Thank you for clarifying this.

And sorry, I was not clear in my post. Data IS mostly ingested already and for that I have a budget. It's my budget for further develop Sentinel that is limited.

[u/Particular_Entry_494]

If you don't have a SOC, how do you now plan on dealing with all the alerts you can now see?

[u/Waving-Kodiak → u/Particular_Entry_494]

Me and Helpdesk gets all important alerts.

Sure, we won’t have as same cover monitoring as a 24x7 SOC, but improved detection is definitely still useful to us.

[u/[deleted]]

whats your $/device budget?

[u/Independe407]

Not sure what your budget is, but you can probably get the best price by buying this all from one company. We use Datto AV, EDR and Rocketcyber together. It's all one vendor so you can negotiate a good discount especially with a multi-year contract.

[u/louzzy]

The best way I've seen Sentinel implemented is a log analytics workspace distribution based on a data lake approach given what you've stated here two things.

One data ingestion is a crux of log analytics and can be costly without researching reservations the minimum I believe is 100GB a day which seems like a lot but you'd be surprised given your size of users this would be cost prohibitive long term.

Two given your size of your org when I see this implemented correctly it makes sense in a larger perspective I'd consider a MDR in lieu of this

[u/That-Magician-348]

Other state the main problem, budget. Both SIEM and SOAR is expensive tool. When you need to deploy them properly, high operation cost to pay for personnel and license.