Microsoft Sentinel SIEM Design & Optimisation
Build useful security monitoring with intentional log sources, tuned analytics, clear ownership and cost-aware retention.
Sentinel should answer defined security questions and route actionable alerts to people who can respond. We design the workspace and data plan around your identity, endpoint and Microsoft 365 environment, with clear cost and retention decisions.
Design and operational setup
- Workspace design, access model and retention requirements
- Prioritised ingestion from Entra ID, Microsoft 365, Defender and selected endpoints
- Analytics rules, KQL tuning and workbooks for agreed use cases
- Incident ownership, escalation and response playbooks
- Usage review and cost optimisation based on security value
What you receive
- A working Sentinel workspace with core data connectors
- Around fifteen analytics rules tuned to your environment
- Two automated response playbooks (for example, disable a compromised account)
- A data and retention plan with a monthly cost estimate
- Runbooks and handover for whoever will triage incidents
Frequently asked
Is this a managed SOC?
No. We design, build and tune Sentinel so it produces useful incidents at a predictable cost. Triage can sit with your IT team, your MSP or a managed SOC you choose, and we help set that up.
How much will Sentinel itself cost?
Microsoft bills Sentinel by the volume of data ingested and retained. Many Microsoft 365 and Defender sources are free or discounted; we size the workspace and give you a monthly estimate before anything is switched on.
What does it cost?
Sentinel Foundation starts from £5,750, typically eight days. If you already run Sentinel, a three-day Cost & Detection Review is £2,250 fixed.
Not sure where your business stands?
Book a free 30-minute call. We will tell you the three things we would fix first — no report to buy, no hard sell.