Microsoft Sentinel: pricing, ownership, MITRE coverage
Byline: Oliver Wakefield-Smith, Founder, Digital Signet.
Microsoft Sentinel[3] is the only large SIEM that publishes both a per-GB unit price and a Commitment Tier curve in dollars. Pay-As-You-Go Analytics Logs sit at $4.30/GB list in East US; Basic Logs at $1.00/GB; Auxiliary / Data Lake at $0.05/GB ingest with $0.026/GB-month storage and $0.005/GB KQL scan[4].
The E5 entitlement
E5 customers receive a 5 MB/user/day free Sentinel benefit. At a 1,000-user shop that is 150 GB/month of free Sentinel ingest. Defender XDR data ingested into Sentinel is free too. For a Microsoft-aligned shop this rebases the buying question entirely.
Unified portal
The Defender XDR plus Sentinel unified portal is generally available[30]. SOC analyst workflow can run end-to-end inside one console for the first time; the cost of leaving the Microsoft estate has gone up correspondingly.
What shifted
Sentinel data lake launched 2026 at $0.05/GB ingest and $0.026/GB-month storage with $0.005/GB KQL scan. E5 customers receive a 5 MB/user/day free Sentinel benefit. Defender XDR data ingested into Sentinel is free. Unified portal with Defender XDR is generally available. Pricing reference at https://azure.microsoft.com/en-us/pricing/details/microsoft-sentinel/[3].
Ingest TCO strip
| Vendor | Annual TCO | Basis |
|---|---|---|
| Splunk Enterprise Security | Quote | Quote-only. Request an RFP-grade quote before benchmarking. |
| Microsoft Sentinel | $785K | Analytics Logs PAYG $4.30/GB times annual ingest with retention adjustment. |
| Google Chronicle Security Operations | $8K | Standard tier $0.65 per employee per month times headcount. 12-month retention included. |
| CrowdStrike Falcon Next-Gen SIEM | Quote | Quote-only. Request an RFP-grade quote before benchmarking. |
| IBM QRadar SIEM | Quote | Quote-only. Request an RFP-grade quote before benchmarking. |
| Exabeam New-Scale Fusion | Quote | Quote-only. Request an RFP-grade quote before benchmarking. |
| LogRhythm Axon | Quote | Quote-only. Request an RFP-grade quote before benchmarking. |
| Securonix Unified Defense SIEM | Quote | Quote-only. Request an RFP-grade quote before benchmarking. |
| Sumo Logic Cloud SIEM | $456K | Cloud Flex effective $2.50/GB at Enterprise Suite times annual ingest with retention. |
| Elastic Security | $173K | Serverless ingest $0.85/GB plus a baseline VCU/storage allocation. |
| Panther Cloud-Native SIEM | Quote | Quote-only. Request an RFP-grade quote before benchmarking. |
| Palo Alto Cortex XSIAM | Quote | Quote-only. Request an RFP-grade quote before benchmarking. |
| SentinelOne Singularity AI SIEM | Quote | Quote-only. Request an RFP-grade quote before benchmarking. |
| Rapid7 InsightIDR | $101K | Per-asset $5.62 per month at the entry tier (500-asset minimum). |
| Stellar Cyber Open XDR + SIEM | Quote | Quote-only. Request an RFP-grade quote before benchmarking. |
| Devo Platform | Quote | Quote-only. Request an RFP-grade quote before benchmarking. |
| Snowflake Cybersecurity Workload | $219K | Estimated $1.20 effective per ingested GB across credits and storage at standard tier (excludes detection layer). |
| Anvilogic | Quote | Quote-only. Request an RFP-grade quote before benchmarking. |
| Hunters SOC Platform | Quote | Quote-only. Request an RFP-grade quote before benchmarking. |
| Graylog Security | $274K | Cloud Security tier list approximately $1.50/GB times annual ingest with retention. |
You enter GB/day. You get an annual number per vendor that publishes a unit price. Quote-only vendors are blocked, not estimated.