We're a 500-person retail chain with 50+ physical stores. Our tech stack is mostly Microsoft (M365, some Azure). We're finally getting budget for a proper SIEM, and the shortlist is down to Microsoft Sentinel and Google's Chronicle Security.
I've been burned before by flashy demos that can't handle real-world log volume or produce actionable alerts. I need a tool that my lean IT team can actually manage.
Here's our reality:
* Primary need is detecting threats across endpoints, network, and cloud apps (M365, a bit of AWS).
* We have compliance requirements (PCI DSS) driving a lot of this.
* Team has decent Azure knowledge, but we're not a SOC with 24/7 analysts.
* Budget is real, but wasted spend on "ingest everything" will get the project killed.
Sentinel seems like the obvious choice given our Microsoft investment. But I've heard Chronicle's pricing model (based on ingested volume) can be cheaper for certain use cases, and their detection engine is supposed to be solid.
My blunt questions for those who've lived with either (or both):
1. **Pricing Trap:** Which one gets obscenely expensive faster for a mid-sized business? Is Sentinel's pay-per-GB log ingestion a budget killer compared to Chronicle's?
2. **Operational Burden:** How much continuous tuning does each require to keep false positives down? We can't have analysts chasing ghosts all day.
3. **Retail Specifics:** Any direct experience with PCI-relevant dashboards or retail-specific threat detection rules out of the box?
4. **The Microsoft Lock-in:** Is the native integration with Defender, Entra ID, etc., so good that it outweighs a potentially better-of-breed standalone tool?
I don't need a sales pitch. I need to know which one you'd actually bet your own team's sanity and budget on.
You nailed the big fear with "budget gets killed". Sentinel's per-GB cost can explode if you don't gate it, but you absolutely can. The key is setting up *very* strict ingestion filters in the Data Collection Rules from day one. Skip the verbose Azure Activity logs, focus on security signals.
Since you're heavy on M365, the native connectors are a huge win. Your team can probably get detections built for your main use cases faster, which matters more than a slightly better detection engine you don't have time to tune.
Chronicle's volume pricing *can* be simpler, but you'll spend more on engineering time building pipelines for Microsoft telemetry. For a lean team, that time-burn is a hidden cost.
Dashboards or it didn't happen.
> Which one gets obscenely expensive faster for a mid-sized business?
For your setup? Sentinel, hands down. That budget fear is real. I built a small cost model for a similar company and the Sentinel bill ballooned because they ingested *all* AzureDiagnostics logs by default. You have to be ruthless with your Data Collection Rules from the start.
But here's a counterpoint to just choosing Chronicle for cost: their detection content library for Microsoft sources isn't as deep out of the box. You'll save on ingest but might spend it on engineering time building those detection rules yourself. With your lean team, that's another form of cost.
For PCI DSS, Sentinel's built-in compliance workbooks are a genuine time-saver. That's a tangible win for a non-24/7 team.
You're asking about the faster path to an obscene bill. The answer isn't that simple.
The 'obvious choice' you mentioned is exactly how you get vendor lock-in. Sentinel's cost doesn't just explode from log volume. Wait until you need to ingest something non-Microsoft. You'll be paying them to manage your own data egress fees from AWS. Or buying their connectors.
Chronicle's volume model is a trap too. But at least the trap is about engineering hours, not a tax on every single log. You can forecast hours. Can you forecast your Azure environment's verbosity after a major update?
Doubt everything