After a year on Sentinel, budget pressures forced us to switch to a combined open-source stack (Wazuh, Grafana, etc.). It's been a few months, and my feelings are very mixed.
I really miss the native Azure integration. Having alerts, VM logs, and our Entra ID sign-ins all in one place with built-in connectors was a huge time-saver. Now, I'm constantly building and maintaining pipelines. I also miss the playbooks—they were intuitive to automate our initial response to common alerts.
On the flip side, I don't miss the cost anxiety. Watching the data ingestion meter spin was stressful. Our new stack is far cheaper, even with the extra management overhead. The flexibility is also a plus; we can tweak things exactly how we want, which was harder in Sentinel.
Thanks in advance!
Hi user658, thanks for sharing this. I'm Adrian, a DevOps lead at a mid-sized fintech company. We went through a similar evaluation last year and now run both stacks in production: Sentinel for our core Azure workloads and an open-source stack (Wazuh, Grafana Loki/Prometheus) for our on-prem and containerized environments.
Here's a breakdown based on my hands-on experience with both:
1. **Total Cost for Azure-Native Shops**: Sentinel's biggest hurdle is variable cost. Data ingestion can easily hit $4-8 per GB after the first 5 GB/day commitment, and it's opaque until the bill arrives. Our open-source stack costs us roughly 30% of that in fixed infrastructure (VM compute + storage), but that's with a dedicated 0.5 FTE engineer for upkeep.
2. **Integration & Management Effort**: Sentinel wins for "click-to-connect" with Azure services. Connecting Entra ID, VM logs, and key vaults took minutes. Replicating that with the OSS stack (using the Wazuh Azure module, Logstash, custom scripting) took me about 3 weeks of focused work to build and stabilize the pipelines. The maintenance burden is real, especially after Azure API changes.
3. **Response Automation**: Sentinel's built-in Logic Apps for playbooks are more accessible for analysts. In our OSS stack, we use StackStorm and custom Python scripts for automation. It's more flexible but requires deeper coding knowledge; building our first five automated response playbooks took twice as long.
4. **Performance at Scale**: For pure log search and dashboarding, our Grafana/Loki setup is faster on known queries, often returning results for 50 GB of logs in 2-3 seconds. Sentinel's KQL is powerful but could sometimes take 8-10 seconds for complex joins across large tables. However, Sentinel's unified schema and security graph for incident correlation are things we haven't matched ourselves.
My pick depends on your team's composition. I'd recommend sticking with your open-source stack if you have at least one engineer comfortable maintaining the pipelines and writing automation code. If your team is mostly security analysts without deep DevOps support, the productivity hit might justify moving back to Sentinel for your critical Azure assets.
To make a cleaner call, could you share your average daily log volume in GB and the primary role (DevOps vs. SOC analyst) of the person managing this stack?
still learning
You're spot on about the 0.5 FTE engineer cost for the open-source upkeep, Adrian. That's the hidden premium many gloss over. In my last migration, we actually calculated it closer to 0.75 FTE when you factor in patching, version upgrades for all the components, and the inevitable break-fix when a pipeline connector fails.
Your point on Sentinel's "click-to-connect" versus weeks of pipeline work is the core trade-off. For pure Azure shops, that integration is essentially a management subsidy. I'd add one caveat: Sentinel's automation, while intuitive, can become a cost center itself if you're not careful with query efficiency. Expensive playbooks running on high-frequency, poorly tuned alerts can quietly burn through your commit tier.
Mike
You've nailed the fundamental tradeoff. The management overhead you're describing is the "engineering tax" on that lower sticker price. It's real, and it can burn a team out over time.
One thing I'd suggest exploring, if you haven't already, is the Sentinel vs. Defender overlap. A lot of the cost anxiety comes from ingesting the same security events twice. Sometimes a focused, smaller Sentinel workspace just for critical Azure identity and high-value alerts, paired with your open-source stack for everything else, can give you back some of that integration without the full budget shock.
How's the team handling the shift? Is the extra flexibility worth the constant pipeline maintenance for them, or is it becoming a grind?