BEARCLAVE

Microsoft Sentinel — cost and detection optimisation

The analysis shows what you really pay for in Sentinel, which data serves no purpose and which detections only create noise. The output is a figure for how much the monthly cost will drop and a list of actions ordered by benefit.

Price

from 45,000 CZK

Output

within 3 weeks of getting access

Impact on operations

none, read access only

Book an intro call What the analysis covers

Scope of the analysis

What the analysis covers

Eight areas, always the same. That is exactly why the analysis can be bought at a fixed price without negotiating the scope.

Cost broken down by tableHow much ingest costs and how much retention, which tables make up most of the bill and how the volume has developed over the last month.
Data you pay for needlesslyTables no rule, workbook or query ever reads. And, the other way round, sources that are free and not connected.
Tiering and retentionWhat can move to a cheaper tier without losing usefulness, and where that would instead break queries or evidence for the regulator.
Pricing modelWhether the right commitment tier is set against actual consumption and how far it can be moved.
Analytics rulesHow many incidents arise per week, what share is closed as a false positive and which rules produce that share.
Detection coverageWhich attack techniques are covered, which only appear to be, and where a detection is missing for data you already pay for.
Connector healthConnectors that quietly stopped collecting, duplicate collection of the same thing and gaps in collection over the period observed.
Automation rulesWhat happens to an incident automatically today, what is repeated by hand and what of that is worth automating.
What the analysis does not include

Deploying new connectors, writing new detections and running Sentinel. That is separate follow-on work, agreed on its own.

Inputs

What we need from you

  • An account in your environment — either a guest invited into your tenant, or one you create in it. One is enough, it has read access only and you remove it at handover.
  • Read access over the workspace and over the resources Sentinel runs on.
  • Read access to cost data. Without it the cost cannot be broken down, and it is the item most often forgotten.
  • An hour with whoever actually handles the alerts. The most valuable input of the whole analysis.
  • A note on what must not be switched off — rules or data kept because of an audit or a contract.

How we treat your environment and data →

Deliverables

What you get

  • A cost breakdown quantifying how much the monthly bill will drop and what to do to get there.
  • A list of actions ordered by benefit, each with a priority and an effort estimate.
  • A rule review — what to fix, what to switch off, what to add, with the reasoning.
  • A PDF report with findings tied to specific settings.
  • A simple summary for the board — where you stand, the three biggest risks, what to do about them.
  • A handover record with the list of open points.
Download a sample deliverablePDF in Czech, based on an anonymised environment

How it runs

How it runs

Intro call

Thirty minutes. We get to know each other and go through your environment, the licences you have bought and how much log data flows into Sentinel today.

Access

The account and named roles, always read-only. Your administrator arranges it.

Collection and assessment

Data is pulled with our own tooling and assessed outside your environment. No impact on operations.

Handover

An hour-long presentation of the findings, handover of the report and a decision on what comes next.

Frequent questions

What people ask most often

How much can realistically be saved?
It depends on how much data is collected without benefit today and whether the right pricing model is set. You get the estimate from the analysis, because any figure given in advance would be marketing. The saving also only shows up in the next billing cycle, not immediately.
Will this break anything for us?
The analysis does not touch the environment, it works with read access only. Every later change goes in batches and you approve it in advance. What must not be switched off is the first thing we ask about.
Do you run Sentinel afterwards as well?
No. Bearclave builds and tunes the environment; round-the-clock monitoring and incident response are delivered by a security operations centre. If you are looking for one, we will recommend a partner and help with the handover.
We have an external security operations centre. Does this still make sense?
Usually precisely then. The operations centre works with what it is given, but the quality of the data and the rules is your responsibility. The analysis shows where the noise arises that you pay for twice — once in data, once in analyst time.
Will anything stay with us that we can use ourselves?
Yes. The outputs are yours. If we follow up with an implementation, the configuration is created in version-controlled code and handed over to you, either as repository access or as an export — whichever we agree on.

Related

What it leads on to

Hardening M365 and AzureMost noisy detections have their root in the environment configuration, not in Sentinel. NIS2 and DORA — compliance of the Microsoft environmentLogging and retention are what compliance is evidenced with.

Finding out whether it pays off takes half an hour

All we need to know is how much data is collected and how many rules are running. The rest comes out of the analysis.

Book an intro call Back to the services