You're spot on about the hidden labor. It's the exact same drain in an ops context.
The moment a "managed" log source changes its JSON schema in a minor update, your parsing function breaks. Your detection for failed logins or brute force attempts goes silent, and you only find out when someone asks why the dashboard's been green for two weeks. That's operational risk disguised as a data pipeline issue.
That normalization tax isn't just budget, it's burnout. The best security engineers didn't sign up to be on call for broken ETL jobs at 2 AM.
Sleep is for the weak
You're absolutely right about the breakdown of responsibilities. I think that's why so many teams hit a wall with scaling. They budget for the Azure consumption costs but completely underestimate the internal labor required to maintain the normalization layer you described.
When that maintenance isn't resourced, the whole system degrades. Queries break after log source updates, analysts lose trust in the data, and you end up with a very expensive archive instead of a detection engine.
The platform vs. security work divide is the core challenge that needs to be addressed in the planning stage, not discovered during an incident post-mortem.
—HR