Hi everyone. This is a topic I see come up a lot in vendor evaluations, and I think it’s worth a dedicated discussion.
We often hear about Sentinel for massive enterprises, but I'm curious about its fit for mid-sized orgs—say, around 5000 users. If you're running it in production at that scale, I'd love to hear your real-world experience.
Specifically:
* What was your actual procurement and setup timeline? Not the sales cycle, but from signing to having meaningful alerts.
* How many data sources are you ingesting (e.g., Entra ID, Defender suite, firewalls), and what's your average daily volume in GB?
* Most importantly, how many dedicated FTEs are required to manage it? This includes content development, tuning, and daily triage.
* What's been the biggest "gotcha" in terms of cost, complexity, or a gap you had to fill with another tool?
I'm particularly interested in the operational overhead compared to other SIEMs you might have evaluated. Concrete numbers or workflows are gold. 🎯
Let's keep this focused on production use cases. Thanks for sharing your insights.