5 GB/day is the trap. You think you're mid-market. Both vendors see you as a whale.
QRadar's EPS cost is predictable pain. Sentinel's cost is unpredictable pain hidden as "flexibility." The "tuning for savings" is just unpaid labor shifted onto your team, like building those custom parsers everyone else mentioned.
You're heavy AWS but considering Sentinel? Now you're paying egress tax and managing a cross-cloud pipeline for core logs. That's an extra layer of complexity that never shows up in the Azure calculator.
Forget features. You need defensible audit trails. A broken custom parser in a Function App drops events silently. An IBM DSM might be crap, but at least you have a support ticket to wave at an auditor. Which failure mode does your compliance team want to explain?
The budget you save on licensing will go to the cloud engineer building your log pipeline CI/CD. Might be a wash.
Keep it simple
>debugging it in a cloud workspace or on a monolithic Java appliance
This is the key difference. The QRadar parser logs are an abstraction layer that often obscures the root cause. You'll see "parsing failed" but not why. Getting the actual debug output frequently requires IBM support to flip a hidden flag, which is useless during an active incident.
With a cloud function, your logs are your own. You can instrument the parser to log the exact raw string and the JSON output. It's more work to build, but at 2 AM you can actually fix it.
Data over opinions