Hi, Started with the Sentinel 31 days trial 2,3 days ago. Had a quick look at the Microsoft Sentinel Cost workbook, as it looked promising. As noted in the description “it provides insight about possible impact of the Microsoft 365 E5… More on learn.microsoft.com

Microsoft security consultant here. Sentinel runs on log analytics workspace, which is an Azure resource, therefore PAYG model. The cost will depend entirely on how many logs you are ingesting. Some key points First 5GB storage is free (each month, although don't quote me on this as I could be wrong now) O365 logs (exchange, teams and sharepoint) are free Azure activity logs are free as well. With the new XDR unified platform, there is no need to ingest the Device-* data tables. These used to be expensive as device logs are very noisy. Only companies that require data retention for these logs can forward them. Basic deployment MUST include entra id sign in logs + audit logs + service principals + non interactive logs + intune if it applies to your environment. You need to learn about data collection rules so you can filter out / drop columns you don't need, thus saving ingestion costs. Also, learn the different tables (basic and auxiliary) as by default, analytics tables are used across different sources. As a monthly cost reference, one of our customers has around 250 users, and the cost is around 10 £ (ingesting basic logs as mentioned above). Other customers are well in the 3 digits as they have larger cloud footprints ie firewalls, on prem services etc. More on reddit.com

Talk with sales and see if they can get you a trial period so you can measure your ingest. There is a pay as you go option and it’s best if you are under like 70gb iirc. More on reddit.com

To do any decent estimation you need to give solid info based on facts. Because you environment is different from all others, and there are 100 of factors that can take it in one direction or the other. https://youtu.be/ryqjtFvXf44?feature=shared This goes through the different cost increases and decreases. My rough average is, but the less servers you have, the more off these numbers will be, taken from average number of roughly 10k servers, DC's will generate alot more ofc, but if you average out, well.. yeah.. Windows Server 300mb/day Linux server 40mb/day But that is based off our data collection, is yours the same? Might be, but does your servers do the same thing? The amount of conditional access policies will highly impact your signinlogs and aadnoninteractivesigninlogs, event size will go from 1000bytes to 15000bytes. Dns? What type of filtering are you looking at? How aggressive are you/the org willing to be with filtering data? Firewalls? Traffic? Ips? Webfiltering? There are so many variables, and above are just the easy ones Compliance requirements? Retention Automation? Enrichment? Need that enterprise api key for virustotal? Paid threat feed vs free? Infrastructure cost for logforwarding solutions, egress cost for cloud, whether that is between Azure regions or another cloud. Iac and DevOps/GitHub to have a good deployment pipeline and not just yolo cowboys in the environment? More on reddit.com