Run a SIEM your team can trust
Many teams think a Sentinel rollout means you just turn on the data feeds and the alert rules. That shortcut fails fast. Within two months, two things go wrong. The data bill grows each month. And your analysts drown in alerts that turn out to be false.
A plan in three steps of 30 days avoids both. It helps your security team do four things:
- Collect the logs that matter.
- Keep data costs down.
- Tune rules against real threats.
- Let playbooks handle the first steps of each case.
Days 1 to 30: get the right data in
Sentinel stores logs in tiers. Keep the logs you search each day apart from the logs you only keep for audits.
- Start with free logs: Bring in Defender alerts, Office 365 logs and Entra ID logs. Microsoft does not charge to load these.
- Filter before you pay: Do not send raw firewall and Linux logs straight in. Use data rules to drop noisy events first, so they never add to the bill.
- Move old logs to cheap storage: Keep 90 days of logs ready to search. Move older logs to the archive tier. You still keep a full year, as NIST asks, for much less money.
Days 31 to 60: tune your rules
Once the main logs flow in, write rules you can trust. Sentinel rules use a query language called KQL. This rule flags anyone who gives a user an admin role:
// Detecting Suspicious Privileged Role Elevation via Entra ID Audit Logs
AuditLogs
| where TimeGenerated > ago(1h)
| where LoggedByService =~ "Core Directory"
| where OperationName =~ "Add member to role"
| extend TargetRole = tostring(TargetResources[0].ModifiedProperties[1].NewValue)
| extend Initiator = tostring(InitiatedBy.User.UserPrincipalName)
| where TargetRole in ("Global Administrator", "Privileged Role Administrator", "Security Administrator")
| project TimeGenerated, OperationName, TargetRole, Initiator, IPAddress = tostring(InitiatedBy.User.IPAddress)
Days 61 to 90: let playbooks act first
By now, playbooks can take the first steps on their own:
- Cut off a device: Defender takes a hacked laptop off the network. Your team can still look at it.
- Lock an account: Sign the user out, reset their password and open an urgent ticket.