Newbie Question - Sentinel Deployment: Cost & Effort Required

Question

I'm considering deploying Sentinel for our Azure & Non-Azure environment. We're a small, nonprofit Windows shop.
Where is the best place to get an idea of the cost and effort involved?

Answer 1

I would start with Defender for Endpoint which requires an E3 or E5 (or equivalent) license. This is a user license. There are many M365 benefits with E3/E5 and there may be non-profit discounts. This is the biggest bang for your buck and is a predictable price. MDE goes a long way to securing servers and endpoints with a good dashboard. Sort of a cookie cutter Windows SIEM. I would also look into MDI to secure on-prem domain controllers.

Sentinel is a more advanced SIEM. It takes more effort to configure and manage. Best for monitoring signals from a wide range of services in Azure, in other clouds, and on-prem. You pay per GB ingested. Somewhere around $4.5 per GB in the US. There are cost controls but calculating costs is somewhat difficult.

Anyway, I find the value of Sentinel is diminished if the other MS security services are not onboarded first like MDE, MDI, MDO, MDFC (ASC), and MDFCA (MCAS),

Answer 2

@Alex Alborzfard
Thank you for your post!

Adding onto what @Andrew Blumhardt mentioned, the best place to get an idea of the cost and effort involved in deploying Azure Sentinel will be the Microsoft Sentinel pricing webpage and the Microsoft Sentinel documentation.

Additional Links:
Best practices for Microsoft Sentinel
Microsoft Sentinel workspace architecture best practices
Quickstart: On-board Microsoft Sentinel
Connect your threat intelligence platform to Microsoft Sentinel
Microsoft Sentinel pricing - FAQ
Microsoft Sentinel Overview

If you have any other questions, please let us know.
Thank you for your time and patience throughout this issue.

----------

Please remember to "Accept Answer" if any answer/reply helped, so that others in the community facing similar issues can easily find the solution.

Answer 3

Many additional recommendations can be found here:

• Azure Sentinel Deployment Best Practices
• The Azure Sentinel Best Practices Series