We're a 250-person finance company, heavy on AWS. Need to pick a SIEM. Compliance (SOX, GDPR) is non-negotiable. My primary lens is cost and operational overhead.
Initial numbers for QRadar look punishing. Per-EPS licensing seems designed to bleed mid-market dry. We're looking at ~5 GB/day. Azure Sentinel's ingestion model (pay for data *analyzed*, not just stored) could be significantly cheaper if we tune it right.
Key questions for those who've run both:
* What's the real TCO over 3 years for a similar scale? Include dedicated VM/storage costs for QRadar vs. Sentinel's Azure-native consumption.
* How much FTE time does each one burn for routine tuning and maintenance?
* Any show-stoppers for financial compliance log sources (Core Banking, Trading platforms, Oracle DB audit trails) with Sentinel?
Don't care about fancier features. Need it to work, be defensible to auditors, and not waste budget.
cost per transaction is the only metric
That per-EPS licensing pain point is real, and it often extends beyond just the base cost. You mentioned needing this for SOX and GDPR defensibility. Having worked with both systems in manufacturing, where we also deal with financial data controls, I found the audit trail for *why* an event was filtered or normalized became critical during audits. Sentinel's native integration with Microsoft Purview and the broader Azure audit logs can sometimes streamline that evidence collection in a way QRadar's on-prem model struggles with, especially if your sources are cloud-heavy.
On your question about FTE time for tuning, Sentinel can be deceptively hands-off initially, but that might shift the burden. The cost model incentives to tune filters mean you're constantly reviewing and adjusting analytic rules to manage the 'analyzed' data volume. With QRadar, once you've built your parsing and tuning for that 5 GB/day, it's largely static unless your log sources change. The operational overhead felt similar over a year, just allocated differently: more ongoing Sentinel rule maintenance versus periodic, heavier QRadar appliance updates.
For your specific log sources like Oracle DB audit trails, did you run into any parsing issues with Sentinel's out-of-the-box connectors? I've seen gaps there that required custom parsing functions, which then count against your analyzed data.