Solid breakdown on how table-level visibility changes the whole Sentinel cost conversation. The bit about moving from guesswork to dependency maps is huge, especially when MSSPs need to justify evry dollar to clients. One thing I'm curios about is how organizations handle the political side once they map everything and realize half thier detections rely on barely-used tables with massve ingestion.
Good perspective. A strong SIEM engineering team doesn’t just turn logs on for analytics—they understand and can justify why each log source and table is needed. That naturally surfaces important questions about retention and compliance that are often missed at a table-by-table level.
It’s also worth noting that the same tables can serve different use cases, so really knowing your data and requirements is invaluable, even if you later optimise. A structured review is always worthwhile—especially when you’re planning or evaluating your Data Lake strategy and deciding exactly what data you’ll keep and why you’re keeping it.
But yes, great call. And the answer I feel is a good SIEM Eng Team and Consultant justifying the LLD decisions at the table level to a client if needed.
Solid breakdown on how table-level visibility changes the whole Sentinel cost conversation. The bit about moving from guesswork to dependency maps is huge, especially when MSSPs need to justify evry dollar to clients. One thing I'm curios about is how organizations handle the political side once they map everything and realize half thier detections rely on barely-used tables with massve ingestion.
Good perspective. A strong SIEM engineering team doesn’t just turn logs on for analytics—they understand and can justify why each log source and table is needed. That naturally surfaces important questions about retention and compliance that are often missed at a table-by-table level.
It’s also worth noting that the same tables can serve different use cases, so really knowing your data and requirements is invaluable, even if you later optimise. A structured review is always worthwhile—especially when you’re planning or evaluating your Data Lake strategy and deciding exactly what data you’ll keep and why you’re keeping it.
But yes, great call. And the answer I feel is a good SIEM Eng Team and Consultant justifying the LLD decisions at the table level to a client if needed.
This is a better post than what I had planned on my on blog, thanks for the shout out!
Appreciate the comment! Shout when you do one, and I will direct link it in! Great original work!
I was just going to write a couple of lines and link it to yours 😅
Lol I will take that. Give me a shout with any new stuff to write about! Nice one
I released another tool to genpop today, which is where the tool you blogged about was forked from 😜
I have many content related to sentinel and MCP if you are interested GitHub - davidalonsod/Dalonso-Security-Repo: Share Information about Microsoft Security Products · GitHub https://share.google/dUxU8QVoISt9o7ZxS and https://youtube.com/@davidalonso1867?si=Bbdr_nLwOKKpyecK