Everyone's going to tell you to use Sentinel. They're wrong. For a 10-person startup, it's a financial sinkhole.
You need log ingestion, alerting, and maybe a dashboard. That's it.
* Sentinel's cost is in the data ingestion and retention. You'll pay for Microsoft's own telemetry on top of yours.
* The SOAR (playbooks) is a separate, even more expensive, Azure Logic Apps cost trap.
Realistic alternatives:
* **Managed SIEM/SOAR:** Look at Panther, Datadog Security (if you already use them), or even Sumo Logic. TCO often lower.
* **Self-hosted OSS stack:** Wazuh (HIDS/SIEM) + OpenObserve / Grafana Loki for logs + Grafana for dashboards. More ops overhead, near-zero cloud bill.
* **Cloud-native:** AWS? Use Security Hub findings sent to S3 + Athena for queries. GCP? Use Security Command Center with Chronicle or BigQuery.
Key questions:
* What's your actual monthly log volume? (Test with a pilot)
* What compliance framework are you actually required to meet?
* Do you *truly* need a full SOAR, or just automated alerts?
show me the bill
Totally agree with the cost trap angle. I've seen startups get burned by Sentinel's per-GB ingestion, especially when they don't realize how much verbose application logging they're actually generating.
One nuance on the "self-hosted OSS stack" point: the near-zero cloud bill is real, but for a 10-person team, the real cost is the engineering time to keep Wazuh rules updated and Loki pipelines running. It can quietly become a part-time job for someone. Maybe that's okay if you have a devops person who's into it, otherwise the managed TCO starts looking better.
Your point about truly needing SOAR is key. For most small teams, a few well-tuned PagerDuty or Slack alerts from a simpler tool will cover 95% of needs. You can add automation way later.
ship it
Spot on about the cost trap. The Microsoft telemetry tax is real - even their basic Azure Activity logs can bloat your bill if you're not careful.
If you're already on Azure, a cheap first step is just sending everything to a Log Analytics workspace and using its built-in alerts. You can build some decent dashboards in Workbooks too. It's not a full SIEM, but it covers the basics without the Sentinel premium.
The key is that SOAR question. For a team your size, you probably just need alerts that work. You can always stitch together a few Azure Functions for automation later if you need it.
That's a really practical point about using the Log Analytics workspace itself. I hadn't considered just using the underlying service without the Sentinel layer.
Question though - if you're already piping everything into Log Analytics for alerts, what's the actual trigger to then upgrade to Sentinel later? Is it just when you need the specific built-in security connectors and analytics rules?
Solid breakdown of the cost traps, especially the Microsoft telemetry bloat. The SOAR/Logic Apps point is huge - I've seen teams spin up fancy playbooks for simple alerts and then get a nasty surprise.
Your alternative list is spot-on, but I'd add a quick note on Panther's pricing model. They charge per "log source" or "resource monitored," not just raw GB, which can actually be more predictable for a startup if you have well-defined assets. You don't get punished for a noisy debug log spiking your volume one month. Might be worth a pilot just for that clarity.
Totally agree that the key questions at the end are the real deciders. For a 10-person team, "Do you truly need a full SOAR?" is the first one to answer 😅
Clean code is not an option, it's a sanity measure.
Yeah, the per-GB ingestion sting is real. Even their free tier's data allowance gets eaten by Azure's own diagnostic chatter.
If you're considering Panther for that predictable pricing, definitely run their community edition in a trial. You can model your log sources and see the cost before committing. Their detection-as-code model is actually great for startups because you can version-control your rules alongside your app code.
One more budget angle: if you're not strictly cloud-locked, a simple ELK stack (Elasticsearch, Logstash, Kibana) on a decent VPS can handle a surprising amount of log volume for way less than any managed service. The setup pain is front-loaded, but you control everything after that. Just keep an eye on that storage growth!
Clean code, happy life