My name is Dave Branscombe, I am a partner solutions
architect.
I focus on security primarily Sentinel these days, Security Copilot
and Defender, those are the the, the hot topics lately
and So what we're going to talk about here specifically
is Sentinel and some of the the areas where you
as a seller may be confronted with with questions or
licensing discussions and and things that may be a little
bit, maybe a little bit foreign when when it comes
to selling a SIM.
So the way that we're going to address this is
simply these three topics, targeting and pitching Microsoft Sentinel licensing
and pricing considerations and then objection handling and best practices.
So let's kind of dig right into this.
So the first one that has to do with targeting
and and pitching, who is it that you're going to
be talking to and what is the actual benefit, the
advantage of using Sentinel as a SIM.
So if you kind of take a step back and
and and start thinking about who your audience is going
to be, If you kind of look at the the
the slide here, it kind of gives you a a
little bit of a hint about who you're going to
be talking to.
Probably you're going to be talking about security obviously to
people like a SISO in in the the customers environment.
So Chief Information Security Officer or a CIOCTO that level
is generally the, the group that has has a budgetary
control over purchases for things like a Sam or other
types of security products.
And the discussion is generally going to focus on things
like their their typical cybersecurity concerns and what we see
in most organizations.
Practically every organization has been impacted in one way or
another by some type of ransomware attack.
Whether they have been completely compromised by ransomware or just
one or two machines, there's a concern around ransomware.
So as the as the slide points out on on
the far left hand side and this the statistic is
from 20/21 that security researchers have tracked a 130% increase
in ransomware attacks and that number was even worse in
2022.
So this is something that is on the minds of
every single organization of of any size and something that
that that they're going to be concerned about how do
we block these types of attacks, how do we respond
to them effectively You don't want to do that while
breaking the bank and and that takes us to our
middle section costs are increasing.
So the average cost of recovering from a ransomware attack
is in the neighborhood of about 2,000,000 bucks.
So it says 1.85 million.
But that number has gone up and it depends on
on who you're talking to and and what they factor
into those costs.
But you know, suffice it to say it's not cheap
to recover from these ransomware attacks.
And you know the the the larger the organization, the
more expensive it can be.
As a result of of many of these things, there
is a concern around the cybersecurity staffing shortage.
So the right hand side makes the point that organizations
are feeling the pressure to find people that are qualified
to handle security incidents in their organization.
And because it is hard to find people that have
that skill set, there is a risk to just about
any organization.
I'll I'll say that even within Microsoft it can be
difficult to find people you know from outside if we
want to hire people from outside, people that have the
right skill set to to handle cybersecurity discussions or cybersecurity
incidents.
So these are the the, the discussion points that your
customers are going to be concerned about and as I
mentioned that's going to be at the C level, you
know your CSO, your CIO, your CTO.
But beyond that we have concerns from people at kind
of the operational level, the SoC team.
So it might be you know the the the SoC
manager, security operations center manager, it might be SoC analysts
and and the challenge that they're facing is what's described
on this slide that the use of traditional SIM solutions
is not meeting the the standards that most of them
have for securing their environment.
So because of what we experienced with the pandemic and
we saw very quickly the expansion into hybrid work, remote
work, we saw very quickly the attackers pivoting to attacking
organizations through those remote remote workers.
And that required a transition of IT organizations to figure
out how do we block this, how do we prevent
this type of attack because we're used to protecting within
the walls, right within the walls of of their their
organization And now those walls have extended out to people's
homes and and in many cases that has continued to
even post pandemic people are are working remotely in many
cases.
So organizations are challenged to protect their digital assets even
outside the organizational walls.
There is a continuing acceleration and increasing sophistication of cybercrime.
So while we are very excited about things like Security
Copilot and ChatGPT and and all these other AI type
of initiatives, you have to factor in the in in
in the, in in the discussion.
The the reality that criminals are leveraging AI as well
and they are using it to get faster, to get
better at what they're doing and to defeat the mechanisms
that we've got in place to to block them.
So it's kind of this you know, arms race between
the good guys and the bad guys just as it's
always been, but it's it's getting faster and and more
automated.
It is becoming more challenging to handle the rising costs
as we alluded to a few moments ago.
And then when you are using traditional Sims there is
also the cost that comes with building out the infrastructure
to support the SIM and that's going to include things
like the servers that are running the SIM software, the
hardware for storage and and you know a SIM can
consume a massive amount of storage and that can quickly
add up not just to you know dollars and cents
but to space in a data center which is often
at a premium by itself.
Then you got things like backup networking, you know the
the, the cooling, the electric of of of an on
premises infrastructure.
All these things lead to this this problem of the
traditional SIM not meeting the requirements of of many organizations
today.
So how are we solving this problem with Sentinel #1
cloud scale protection.
So being able to deliver SIM services from the cloud
eliminates many of the problems that that the traditional Sims
face.
So you're able to grow quickly, you're able to expand
your storage very quickly.
But beyond that, performance isn't going to be impacted the
way it might be with an on premises SIM.
So if you have provisioned your servers to accommodate a
certain amount of of ingest log data and things like
that and then that that increases or you know the
the the, the, the scale changes for that ingest those
servers have to be reprovisioned or or you have to
add to the servers, you know the the, the array
of servers that are accommodating that ingest.
So it becomes challenging to keep up with the with
the pace of the technology.
It also can help us to increase our sock efficiency
because we can leverage tools that are really only ideally
available in the cloud.
And and and when I say ideally available, what I
mean is that there are AI tools that can be
run on premises.
But again you're constrained by the hardware that that that
you can provision within the data center.
When you provision it in the cloud, you're taking advantage
of cloud capabilities.
And so the AI and the machine learning capabilities are
are you know vastly more scalable in the cloud than
they are on Prem.
And because of that you're able to do pour over
the data much more efficiently and leverage the tools some
more effectively.
It allows us to streamline our operations and the last
point that's made there is transforming security operations.
So rather than having islands of security tools, by leveraging
the Defender stack along with Microsoft Sentinel, you can have
a comprehensive view of your entire security infrastructure.
And we'll talk about the improvements that were announced around
that recently at Ignite.
And it's something that many security organizations have been looking
forward to for many years and it's it's finally available
within the Defender and Sentinel stack.
So just to kind of highlight some of the the
points that or or dig deeper into the specific points
that that I was highlighting there.
Being able to to leverage the cloud for your protection
as well as the flexibility that the cloud offers.
So being able to to use the the, the, the
cloud allows you to take advantage of the scale of
the cloud in in ingest of log data but also
in scaling out the storage that you might need.
So if you think about what's involved in scaling out
storage in an on premises environment, it's not, it's not
terribly simple.
So you have to order the storage, you have to
bring it into the data center, you have to, you
know, unbox it and make sure that it it's all
provisioned properly.
You have to carve out storage, maybe Luns and and
stuff like that and you know, make it available to
the right servers, all that kind of thing.
Whereas when you provision storage in Sentinel, it's a few
clicks and you've got, you know, a whole new storage
array available to you and you know you don't have
to do any of the management behind the scenes.
So that by itself makes management of Sentinel a a
a real boon to many organizations where time and and
the you know the skill sets are at a premium.
So as the the, the point that's highlighted there at
the bottom in the the the blue box 67% decrease
in time to deployment with pre built SIM content and
out-of-the-box functionality.
I would kind of argue that it's even faster than
that because if you factor in you know the the,
I mean I can get Sentinel up and running within
probably 5 minutes and there is no way that I
can get Splunk up and running in 5 minutes, right.
So you know 67 percent is maybe being a little
conservative, but that's that's one of the things that that
we want to think about is, is the the speed
which with which you can provision and manage your infrastructure.
The the, the point that we made with regard to
the efficiency of the SoC.
There's a couple things that come into play with regard
to Sentinel that make it unique from a SIM perspective.
One of those is the built in capability to use
UEBAUEBA stands for user and entity behavior analytics.
What that does is it allows you to look at
the behavior of users, the behavior of devices, the behavior
of, you know, what's taking place from a specific IP
address and kind of a profile, the way that behavior
changes over time.
And so if I see a user that logs into
one specific machine for weeks and weeks, and then all
of a sudden they're logging into a machine that is
in a different location and they're logging in at an
entirely different time of day, things like that.
UEBA can help to surface that information and and and
tell us, OK, something's wrong here, this isn't the way
that this user typically logs in and it can raise
alerts.
The other thing that Cloud SIM allows you to do
is take advantage of automation, so we call that SOAR.
So security operations, automation remediation or automation response, I can't
remember what the R stands for, but in case it's
talking about orchestration and automation and remediation through automation tools.
So because that's built right into Microsoft Sentinel, this can
be very quickly leveraged by an organization whereas it might
take a little more time to create this kind of
tooling if if you're using an on premises environment.
We have the hunting capabilities and the ability to leverage
Microsoft's own threat intelligence.
So they're just to kind of take a step aside
for a moment, there are the there's a free threat
intelligence feed that is is provisioned through Microsoft Sentinel.
And there is a paid Microsoft Defender threat intelligence service.
So anybody can take advantage of the built in tooling
for Microsoft threat Intelligence in Sentinel that'll give you information
about bot Nets and malicious IP addresses and things like
that.
Whereas Microsoft Defender for threat intelligence gives you information about
the threat actors that are behind those IP addresses and
then behind those bot Nets and what their objectives are,
who they target, things like that.
So it's a little more detail around the infrastructure that
cybercriminals and nation states are using to perform their attacks.
So again there there, there's a lot of tooling built
into Sentinel that in many cases you'd have to pay
extra with a with an on premises SIM And because
we can take advantage of Microsoft's threat intelligence and and
and our knowledge of how attacks are taking place, it
makes the the you know the customer more secure as
well.
The third one kind of along the same lines with
that AI discussion.
So one of the things that was, you know is
being highlighted repeatedly is the integration of Microsoft Security Copilot.
So Security Copilot is a tool that allows you to,
using natural language, communicate with the systems that are securing
your environment.
In other words, systems like Entra and Intune and Defender
and Sentinel, you can simply ask questions to Security Copilot
and say can you tell me more about the alert?
You know the the alert number 1234 that's highlighted in
in the the screenshot there and it will give you
natural language responses that can help you to more quickly
address the situation and figure out ways to remediate the
problem.
So Security Copilot is one of the big advantages that
many organizations are looking to take advantage of.
Many partners are looking to take advantage of as a
way of enhancing the skill based model within a security
copilot and and and to help their SoC teams become
more effective in in the way that they handle incidents.
This is what I was referring to before as the
thing that was announced at Ignite in in November just
a couple weeks ago.
So it may not seem like much of the screenshot
that you're looking at here, but what this is actually
showing is an integrated view of Sentinel and Microsoft Defender
XDR in the same portal.
So previously you had your Defender portal where you had
your defender for endpoint and defender for identity and defender
for cloud apps, Defender for Office 365, etcetera.
And then in Azure you had your portal for Microsoft
Sentinel.
And you know two portals is manageable, but one portal
is even better, right?
So the integration of Sentinel into this portal now brings
all the the the tooling together in one place and
it allows you to very quickly transition between one blade
and the next, one tool and the next without losing
context.
So you can move between these different tools without going
into a different browser or a different, you know, application
that that might be required if you've got multiple tools
deployed within the customer organization and as it points out
in the holistic response bullet point.
All this is again accessible with the Security Copilot tool.
So you you you get the Security Copilot tool integrated
into this experience and you can simply ask questions and
and it will help you to come to a conclusion
about how to remediate the issue.
So really, really you know overall the messaging that you
that you can present to the security people within your
customers organization whether they're at the operational level or all
the way up to the, you know the C-Suite level,
Sentinel and Defender as a whole present a really, really
good message to them in terms of being able to
save money as well as improve the efficiency of the
SoC.
All right.
So let's get into the the idea of licensing and
pricing and this is one of the areas where it
it becomes very challenging to have this discussion because there
may be a lack of knowledge around how to properly
size and scope a Sentinel deal.
So at a very high level, the things that are
going to influence the cost of a Sentinel deployment are
the things that are listed on the left hand side
there.
So the amount of data that you're ingesting measured in
gigabytes per day is, is by far the biggest portion
of the cost.
So there are, you might have logging that's coming from
on premises servers, logging that's coming from Office 365, from
Azure, from AWS, from Google.
You can you can bring in logging from any number
of sources that you want, but it is going to
have an associated cost and so you have to think
about those things and and be strategic in in what
type of logging you bring in.
Don't just ingest everything whether it's performance data or whatever
because there are better ways to address some problems.
What you want in in your Sentinel environment is your
security data specifically and so being specific about how you
ingest data and and making sure that the data you
bring into Sentinel is specifically useful for security threat hunting
and and for investigating threats.
That's going to help reduce the amount of of storage
that you have to provision and and manage and and
pay for.
The 2nd bullet point points out that there are some
types of logs that you can ingest for free.
At the end of this section of the deck, there's
an appendix, and in that appendix there are some specific
programs that highlight what you can ingest for free into
Sentinel.
So things like your Office 365 audit logs, Azure activity
logs, these are things that can be ingested at no
cost.
Then there are things that you have to pay for.
So if you're bringing in firewall logs from a Cisco
appliance or a Palo Alto appliance, whatever, that's going to
cost money.
But there are are probably 10, maybe a dozen different
logs that will always be free to ingest into Sentinel.
And and those are typically the Microsoft logs.
There are also what we call basic logs and analytic
logs.
Analytic logs are logs that are very detailed and can
be very useful when you are doing things like threat
hunting and querying against data to find out what's taking
place in your environment.
Those cost more to store than basic logs.
Basic logs are things like network logs.
So if you look at a network log, there's a
lot of traffic going back and forth and you know
a a maybe a minimal amount of it has security
value.
A lot of it is just telling you that things
are happening but but they're not necessarily security value.
So a lot of organizations want to ingest those basic
logs, but they only need certain fields and because of
that the basic logs have a, a a limited amount
of of fields that are available.
The retention on them is is shorter and the the
the cost of ingesting these logs is significantly lower.
So think about what kind of logs you need and
and what the security value is of those logs.
Depending on the location of where you're provisioning Sentinel the
the prices are different in different regions.
So if you provision in the in the US East
versus the US West, there is going to be a
difference in cost.
So think about where your resources are located and what
makes the most sense from a a positioning standpoint where
to locate Sentinel.
There are bandwidth costs that you have to think about,
but but I I would not spend a lot of
time worrying about this cross region egress and cross cloud
egress.
That's not going to be a significant factor in your
sizing model.
Your billing model pay as you go are capacity tiers
or commitment tiers that will have a difference or or
or that will make a difference because the capacity tiers
do provide you with significant discounts the more you commit
to to storing.
So you might say I'm going to I'm going to
commit to 100 gig a day of data in in
Sentinel or 200 or 500 whatever it is.
The more you provision the steeper the discount will be.
The features for notebooks, UEBA, logic apps, function apps, things
like that.
That's again a a lesser cost.
I wouldn't worry too much about that one.
Retention and long term storage options does tend to be
a a larger amount of your sizing cost.
So again it's just storage, right.
So so you're you're you're keeping the store the the
data for a longer period of time.
So because it kind of goes into a a warm
or cold storage state, it's not actively being used on
a regular basis.
It is cheaper storage but it does cost money and
and there are different storage options available and we'll talk
about those in just a minute.
So some of the advantages of the Sentinel pricing model
is that you know as as I alluded to there
are different methods for provisioning your storage pay as you
go or capacity tiers and if you start using capacity
tiers or commitment tiers.
It it, it's kind of used different ways and different
documentation, but but the same thing, you do have the
ability to move up to a different tier at any
time and if you realize that you don't need to
be in a specific tier and when want to drop
down, you can do that at the 31 day mark.
So there is flexibility there and and then think about
what you'd have to do if you had an on
premises SIM.
When you have an on premises SIM, you have to
provision your storage anticipating what you think you're going to
be storing for the next budget cycle, right?
So, so, so for you know, if if if you
allocate a budget every year, then you have to figure
out how much do I need for the next year
because I can't go back and ask for more money
for storage.
Whereas with Sentinel you're only paying for what you use
and you know that that that can make things much
easier to handle from a budget perspective.
This is just an example that you can use to
compare the pay as you go versus the commitment tiers.
And you know if you kind of use the $4.30
as a price per GB of what you see there
in the pay as you go and and kind of
translate that into the commitment tiers.
If you figured 100 gig per day at the pay
as you go rate that would be $430 right at
the at the pay as you go rate.
But if you're using the commitment tier it's 296.
So you get a pretty significant discount there and and
that discount model gets better each each tier you you
move on.
This is a a pretty useful slide in terms of
understanding how to think about storage and and retention of
data.
So as I mentioned before there is the idea of
your log analytics storage which has the the highest cost
of ingestion and storage.
Your basic logs which have a reduced amount of ingestion
and retention costs and then as you start to move
into the data retention the the, the solid blue area,
the costs get you know they they drop pretty significantly.
And then if you're holding on to the data for
a long period of time like 7 years which is
not uncommon for many financial services customers, you can move
into that data archived here and the the the the
price drops even more significantly.
So the the, the larger kind of Oval areas, those
are the areas that I would think about if I
was going to be doing any sizing of Sentinel.
Those are the areas that are going to incur the
greatest cost overall for the project.
And so, you know, don't worry about the the incidental
costs like you see here, the search job charges and
the restore charges, those aren't going to contribute significantly to
your overall deployment cost.
This is a a table that that gives you a
a rough idea of how you can think about storage,
where the performance is good, what your retention constraints might
be, what the cost of retaining the data would be
and you know what the capabilities offered with each type
of storage are.
Now what I'll say is that most customers who are
looking to store data for a lengthy period of time
go with Azure Data Explorer as their long term retention
strategy.
It has a lot of advantages from a retention perspective,
from the ability to you know, a usability perspective, you're
able to run queries against it, do threat hunting in
that storage area.
So it it it, it's got a very nice feature
set for long term storage retention.
So that's generally the direction that that the larger customers
that I've worked with are going to kind of design
their storage around.
So what do you need to do if you're going
to start your sizing?
You have to understand what your data sources are.
How many gigabytes of data are you ingesting on a
given day?
What is the pricing tier that you're going to use
as a commitment tier or pay as you go?
Where is Sentinel going to be installed?
What type of logs are you looking at?
Do you have any compliance or regulatory standards that you
have to abide by that are going to require you
to retain data for a certain period of time?
Do you have to abide by GDPR because of, you
know you might have a data center in the United
States and another one in EMEA.
So do you have to store data differently in those
regions because of compliance or regulatory standards?
What are your retention or archival requirements?
Do you have any automation needs?
Do you have any logic apps that need to be
configured for automation of responses to incidents?
Are you integrating with Defender for cloud?
And what is the Microsoft 365 licensing model that your
customer is using?
So again look at the appendix to to this deck
or this section of the deck and it will give
you an explanation of those last two bullet points.
Some programs that you can take advantage of to reduce
the cost of ingesting data into Sentinel if you have
those tools in place to find it for cloud or
for example Microsoft 365 E 5, you know the the
the E5A5G5 licensing.
You can get discounts for some of the ingest when
you use the pricing calculator.
There's an online pricing calculator and there is also a
downloadable Excel pricing spreadsheet.
So when you use the online pricing calculator, I kind
of preferred that one because it allows you to do
your sizing and and and cost estimations beyond just the
Sentinel log analytics workspace.
It allows you to size for basic logs, for Azure
Data Explorer, for Azure BLOB Storage, for networking, all those
those things that that I mentioned as being kind of
tangential to your your Sentinel deployment.
Whereas the pricing calculator the the excel spreadsheet only gives
you the ability to look at log analytics workspace.
So, so it is more limited but if you don't,
if you're not going to have access to the Internet
and you want to have a document documented way of
of you know recording your your discussion with the customer,
maybe you use the the excel spreadsheet think about the
the the pricing model that you're going to use.
Again, pay as you go, commitment tiers, dedicated clusters.
So if you have multiple what we call log analytics
workspace, these are storage areas.
If you have multiple of those because maybe you've got
you know some some log analytics workspaces that are measuring
performance of servers and others where you're looking at security
of the servers, you can kind of create a cluster
of those workspaces and get a a discount on the
on the pricing for those.
Keep in mind that many customers have EA or Mac
agreements that will get them discounts that aren't even surfaced
in these pricing calculator.
So when you have a discussion with a customer about
pricing for Sentinel, find out if they have an EA
agreement or a Mac agreement in place that would help
them to, to reduce their their price even further.
We've kind of talked about the analytics logs, the basic
logs, but this is here for your reference so that
you understand what each type of log allows and and
you know what the retention is and you know the
advantages of of using each one.
But I'm not going to just read through the slide
there, it's just really here for your reference and similarly
here with the long term retention using Azure Data Explorer.
Again the the idea behind this is if you start
over at the at the left hand side of the
slide, you got your data sources, they send data into
Sentinel, they're stored for a period of time and then
you use an automated process that will move that data
from your Sentinel higher cost workspaces over into Azure Data
Explorer where it's less expensive and you have a longer
retention capability.
OK.
Thinking about objection handling and best practices for having discussions
with your customers.
So by far the biggest objection that you're going to
get is around pricing and and Microsoft has done extensive
research and and we feel that we are in line
with the the, the, the pricing model that exists for
your common Splunk logarithm, arc site, you know type of
of SIM solutions.
But customers for whatever reason feel that when they look
at the at the price, you know when, when, when
they look at the pricing calculator, they may feel it's
too expensive, the pricing is too hard to understand.
So there are some options that are available to them.
They can use Microsoft funding esif funding where possible, if
they're in the right, you know, customer category and so
on.
As I mentioned, you can use your Mac agreement.
There are certain Sentinel workshops that can be leveraged to
offset the cost of planning for their Sentinel deployment as
well as even some of the pilot deployment costs can
be funded through these workshops.
Fast Track is always a way that customers can use
to offset onboarding expenses as well.
As I alluded to at the beginning of the discussion,
many times customers look at maybe just the licensing for
their Splunk infrastructure and compare that to the overall cost
of Sentinel and that's not really an apples to apples
comparison.
They're not looking at maybe the, you know, the full
cost of storage, the cost of the servers at that
provision, the networking, the operational cost, backups, optimizing the databases
and the downtime that comes with that.
So make sure that they're comparing apples to apples when
they when they say that you know X is is
less expensive than Sentinel.
And as I've mentioned a couple times, there are some
ways to take advantage of different programs that Microsoft's offering
the E5 benefit, the Defender for cloud benefit and the
always free data sources that are referred to in the
appendix there.
There are flexible ways of of reducing storage costs and
moving things out of high cost storage into less expensive
storage, which we've talked about a couple times already.
These are some some points that may be useful in
in your discussions with customers that can help them to
see where where they may begin to realize the advantages
of a cloud based SIM.
So different customers have have noted things like 201% ROI
over the course of three years, the less expensive compared
to on Prem Sims of 48%, reduction in investigation effort,
reduction in management effort, decrease in time of deployment and
so on.
These are all areas where you can have these discussions
around where cost savings can be realized using Sentinel and
the the footnote there, the total economic impact of Microsoft
Azure.
Sentinel from Forster is a really good document.
If you anticipate this type of discussion coming up where
cost is going to be a, you know a very,
very big sticking point with your customer, read through that
document just so that you have kind of in the
back of your mind some of the discussion points that
are are likely to be advantageous.
Another common objection that we hear is you know I
don't want to go to the cloud and and Microsoft
is going to force me to use Azure whereas you
know vendor X allows me to deploy either on Prem
or in the cloud.
So that's I feel like that's a a a a
good, a good choice for me as a customer.
Sometimes what this is hiding is a skilling concern.
So if you change vendors, if you go from Splunk
or from Log Rhythm or whatever it might be, there
may be a concern among the people that have the
responsibility for that system that they're going to become useless
or or that they're going to become obsolete at the
organization.
And so one way that you can kind of offset
that concern or or balance that concern is to include
hands on training as part of the deployment so that
they, they, they, they see a path forward in terms
of their, their role in the organization.
Because really the second point, second bullet point is that
the location of the SIM shouldn't matter as long as
you can ingest the data that is relevant for the
organization, who cares where the SIM is located, right.
But if you get the advantages of a cloud native
deployment, the the performance advantages, the security advantages, the the
advantages that come with being able to scale rapidly, you
know, those generally offset the, you know, concern around whether
it's located in your data center or someone else's data
center.
And so when you compare the value of a hybrid
SIM versus a cloud native SIM, there are a number
of of advantages that come with the Sentinel as a
cloud native SIM.
So on the left hand side, the hybrid SIM includes
in most cases it's going to include a cloud subscription
and a usage fee as well as fees associated with
the cost of setting up your on premises infrastructure, maintaining
that infrastructure, backing up that infrastructure and so on.
That may also lead to you know manpower issues.
So, so the more infrastructure you have to support and
maintain the more people you have to have in order
to do that right.
So rather than than allocating high-priced engineers to to the
job of of provisioning storage and provisioning servers, give them
the the the responsibility of monitoring those systems and looking
for threats in in Sentinel instead of just making them
rack and stack sort of things.
Because you're able to use Microsoft's machine learning and artificial
intelligence tooling with Microsoft Sentinel, you can also reduce the
problem of alert fatigue.
So alert fatigue is is what we refer to as
you know too many alerts and you know when when
you reach a certain threshold people either stop paying attention
to the alerts, they don't give the proper attention to
the severity of alerts and so on.
But if you can use AI and machine learning to
filter through the the the alerts and and only surface
the ones that have a direct impact on the organization,
only surface those to the humans, then it becomes much
more manageable for humans to manage you know a a
a small number of alerts versus you know maybe hundreds
a day.
So leverage the the the power of AI in the
Microsoft cloud to to to reduce those those alerts.
So a couple of things to think about where to
focus when you have these discussions.
As I've mentioned repeatedly, the scalability of the cloud.
You can scale your organization's SIM infrastructure with a limited
amount of management complexity.
A point that I didn't make in in the in
the discussion here is that because Sentinel is a cloud
service, it is Evergreen, meaning it is always at the
latest version within certain you know constraints.
If you want to, you know reduce the, the the
you know.
If you want to be on the on the cutting
edge or or or just on the on the regular
release cycle, it depends.
But generally speaking, it it's an Evergreen service and so
any new features, any new capabilities are rolled out to
Sentinel.
You know every month there there's new capabilities, but it
doesn't mean you have to perform any upgrades.
There's no downtime, you don't do backups and restores.
So it can be much easier to take advantage of
the benefits of of Sentinel without the associated challenges that
might come with an on premise infrastructure.
And then the integration of Sentinel with Microsoft Defender XDR
solutions provides comprehensive coverage across your multi cloud, your hybrid
environments.
And that helps to reduce the gaps in coverage that
might come with a multi solution infrastructure where you have
different vendors providing different types of coverage and there might
be gaps in that coverage that allow attackers to kind
of sneak in.
So as a whole this is the advantage that we
see and and that you can highlight with your customers
is is identifying, you know the the detection of of
threats, allow you to do the investigation of threats, respond
to the threats either with automation or you know through
proactive threat hunting or or or proactive investigation by humans.
The fact that Sentinel will allow you to ingest data
not just from Microsoft sources, but from really any source
you can bring data in from AWS, from Google, from,
you know, any other cloud service.
You may need to to to do some work on
on transforming the data so that it's in a a
format that that Sentinel can leverage.
But the data can come in and and be read
by Sentinel, and so you're not limited to only Microsoft
solutions.
So that brings me to the end of my discussion.
As I mentioned, there are some slides here in the
appendix that refer to the always free data sources.
These are always ingested into Sentinel at no cost.
So that can be an an area where customers can
save money.
This is the the E5 benefit that our customers who
are on the E5 licensing, there are additional data sources
that they can bring in to Sentinel and and get
the you know the the rich context that is provided
in those logs.
And then lastly is the Defender for server customers or
Defender for cloud is is the way I referred to
it earlier.
But basically if a customer has Defender for cloud and
they're using Defender for servers plan two, they can ingest
security data from those servers at the at the rate
of 500 megabyte per VM per day free for the
security tables that you see listed here on the on
the slide.
So I'll stop there if there are.
Let me take a quick look at if there are
any questions pop up in the Q&A.