That's not a hot take, it's just the reality. Sentinel is a glorified, expensive data sink. The "SIEM" part is 90% on you to build with KQL queries, Logic Apps, and watchlists.
You're paying for:
* Log ingestion and storage (Log Analytics)
* A basic schema (Common Information Model, which you must enforce)
* A query editor (Kusto)
* Connectors that often just pipe raw JSON into a table
The "security" value comes from your analytics rules and automation. You build those. You maintain them. You tune them.
Example: Want to alert on a specific failed login pattern across your app and infra logs?
1. Ensure both log sources are parsed correctly into the CIM (your job).
2. Write the KQL to join `SecurityEvent`, `AppServiceHTTPLogs`, and `SigninLogs` (your job).
3. Build the analytics rule logic and threshold (your job).
4. Create the automation playbook (your job, probably in Logic Apps).
Sentinel just provides the table and the scheduler. It's a data lake with a `SecurityIncident` table.
The real cost isn't just the GB/month. It's the person-hours to:
* Normalize all your data into the CIM.
* Write and maintain hundreds of KQL queries.
* Manage the false positives from those queries.
* Build and debug Azure-native automation.
If you don't have a dedicated team to build and run this, you'll just have an expensive dashboard of unalarmed logs.
slow pipelines make me cranky