Sentinel vs Splunk vs SenseOn: SIEM Cost and Detection Compared

Microsoft Sentinel, Splunk and SenseOn all detect threats in security data, but they charge for it in three different ways. Sentinel bills mainly per gigabyte ingested into its analytics tier. Splunk sells compute capacity (workload pricing, measured in Splunk Virtual Compute units) or ingest volume, and publishes no list price. SenseOn has no per-GB ingestion charge: it is priced as an annual pool of credits and runs detection over all the data it holds, in every storage tier. If your SIEM bill is forcing you to choose which logs get watched, that difference matters more than any feature list.

This comparison uses only each vendor's own documentation and pricing pages, read on 23 September 2026, plus peer-reviewed research where it helps. Where a vendor does not publish a figure, we say so rather than estimate it.

Sentinel vs Splunk vs SenseOn at a glance

Sources: Microsoft Learn and the Azure Retail Prices API; Splunk pricing pages and Splunk Cloud Platform service details; SenseOn product pages. All read 23 September 2026.

How each one charges you

Microsoft Sentinel: per GB, with a cheaper tier that trades away detection

Microsoft's billing documentation says pricing "is based on the tier that the data is ingested into". At the East US list price on 23 September 2026, analytics ingestion was $4.30 per GB pay-as-you-go. Daily commitment tiers lower the effective rate, from $2.96 per GB at 100 GB a day. Analytics data is retained free for 90 days. Microsoft 365 E5, A5, F5 and G5 customers get up to 5 MB per user per day of eligible Microsoft data free.

The data lake tier costs about $0.15 per GB to bring data in ($0.05 ingestion plus $0.10 processing). The catch is in Microsoft's own tier comparison: lake data "isn't available for real-time analytics features and threat hunting". Our Microsoft Sentinel pricing guide works through three monthly bills and the limits on detecting over lake data.

Splunk: capacity or volume, and no public price

Splunk's pricing models page lists ingest pricing ("based on gigabytes of data ingested"), workload pricing ("based on the amount of compute and storage resources required to run search and analytics workloads") and, for Splunk Cloud Platform, activity-based pricing, "a dual-meter pricing model based on both ingest and search activity". Splunk's Cloud Platform service details (updated 6 March 2026) say a subscription "is workload-based and is sized for resource capacity. By exception, you may be on an ingest-based subscription that is sized for data volume ingested."

A Splunk Virtual Compute (SVC) is, in Splunk's words, "a unit of capabilities in Splunk Cloud Platform that includes compute, memory, and I/O resources". Workload subscriptions "do not meter ingestion", so you can raise ingest or search load until the SVCs are fully used. On an ingest subscription you can exceed your purchased daily volume "a maximum of five times in a calendar month".

Splunk does not publish a price for Splunk Cloud Platform or Enterprise Security. Its own pricing calculator estimates SVCs from your daily GB, not dollars. Ask for your quote in both workload and ingest terms so you can compare them. Our Splunk pricing guide explains each unit and what to ask for.

SenseOn: no per-GB charge, and three ways the cost comes down

SenseOn is priced as an annual pool of Flex Intelligence Credits. There is no per-GB ingestion charge. Three things bring the cost down:

1. Edge processing removes unnecessary data before it reaches the pipeline.
2. Three-pipeline routing, configured by Weave, SenseOn's security engineering agent, sends each source down the right pipeline, with storage separated from compute.
3. Compression, with pricing calculated on the compressed storage volume rather than raw ingest.

Together these cut costs by about 40% against a traditional SIEM. The saving on SIEM costs alone would be larger, because the price also covers SenseOn's Agentic Cybersecurity Team (ACT), the AI agents that investigate and resolve cases. That work is charged on the agents' activity, not as an MDR service, and there is no charge when a case is handed to a person.

Which of your data gets detection?

This is the question per-GB and per-capacity pricing forces on you, and where the three differ most.

Sentinel splits it by tier. Data in the analytics tier gets real-time analytics rules, hunting and workbooks. Data you send to the lake to save money does not. Microsoft is direct: when you move a table from analytics to the lake, "all real-time analytics and hunting queries stop working". To detect on lake data you build KQL jobs or summary rules, promote their results to an analytics-tier table, and run an analytics rule on that. New lake data takes "up to 15 minutes" to become queryable, and a tenant can run 5 jobs at once.

Splunk splits it by what is searchable. Data in searchable storage can be searched and correlated. After your searchable retention ends, data can go to Splunk's managed archive. Splunk's archive documentation says "the restoration process can take up to 24 hours to complete", and the service details say restored data "is searchable for up to 30 days". Data exported to your own cloud storage through Dynamic Data Self-Storage "will no longer be searchable by Splunk Cloud Platform". A hunt that reaches past searchable retention starts with a restore request.

SenseOn does not tie detection to a tier. It detects at three speeds:

• Real time on the endpoint, through the Universal Sensor, which captures endpoint, network and identity telemetry on Windows, macOS and Linux.
• Near real time across all log sources as they stream through SenseOn's message queue.
• Batch analytics about every five minutes across the data lake.

Data rolls from one tier to the next automatically, and any source can go straight into the tier that suits it, such as verbose logs directly to the lake, without losing detection. SenseOn's AI agents run queries and threat hunts across every tier for the whole retention period. Because they are long-running agents rather than a person at a console, a query over older, colder data can take a little longer without anyone waiting on it. There is no restore step.

Why it matters: the sources teams move to cheap storage are the high-volume ones, such as firewall, DNS, proxy and network flow logs. MITRE ATT&CK notes that for command and control, "adversaries commonly attempt to mimic normal, expected traffic to avoid detection". Our judgement: a pricing model that makes you stop watching network logs saves money on exactly the records you need to catch that traffic.

Detection and analyst workload

Sentinel and Splunk both depend on the rules you write and tune, in KQL and SPL respectively. That tuning decides the outcome. Bryant and Saiedian found that re-engineering SIEM correlation rules raised detection rates and cut false positives, and traced much of SIEM's shortfall to insufficient configuration (Computers & Security, 2020). Oxford researchers interviewing SOC analysts found they reported high false positive rates, mostly benign triggers explained by legitimate activity (USENIX Security, 2022).

SenseOn starts from built-in detection instead. Its Intelligence Fabric correlates endpoint, network, identity and log evidence into cases, and its AI agents investigate them. About 97% of alert noise is removed before an analyst sees a queue, and 92.5% of incidents are resolved by AI under human governance, measured across all customer environments over a rolling 30-day window. Forge drafts and tests detection changes for a detection engineer to approve, so you can still write your own content.

Where each one fits

Choose Microsoft Sentinel if you run Microsoft 365 E5 and Azure, most of your detection data is Microsoft's own, and your non-Microsoft log volume is modest. The E5 data benefit and free Defender alerts go a long way. Watch the bill as third-party logs grow, and be deliberate about what you send to the lake.

Choose Splunk if you have skilled SPL engineers, years of custom content, and use Splunk beyond security for IT operations or application analytics. Nothing else matches its flexibility for teams that can afford to use it. Model SVC growth and archive restores before renewal.

Choose SenseOn if your SIEM bill is making you drop sources from detection, your team is too small to spend its week tuning rules, or you want AI agents to do triage and hunting across all your retained data. SenseOn is a security platform, not general log analytics; keep an observability tool for application logs.

You do not have to switch in one go. SenseOn deploys alongside your existing SIEM and EDR, so you can run it next to Sentinel or Splunk for a 14 to 28 day proof window, compare detections and case volume on your own data, and move high-volume sources off the per-GB or per-SVC bill only where the evidence is clear.

How to compare them on your own numbers

Our SIEM cost calculator does the first pass: Sentinel from Microsoft's list prices, your Splunk quote, and an indicative SenseOn figure, with every assumption shown. Then work through these steps.

1. Measure daily volume by source. Split it into data you need for real-time detection and data you keep for audit or forensics. NIST's log management guide, SP 800-92, asks you to set a purpose and retention period for each source.
2. Price Sentinel from Microsoft's list. Pick the commitment tier whose break-even point you clear on most days, then add retention past 90 days and lake meters.
3. Ask Splunk for a quote in both models. Get the SVC count for your search load and the GB-a-day price, plus the archive and restore terms.
4. Ask SenseOn for a credit plan covering the same sources and retention, and what the agents' investigation work adds.
5. Count what each option leaves unwatched. For every source you would move to a cheaper tier, write down whether it still gets real-time detection and hunting.
6. Run a proof on your own data. Use your top 20 detections and three closed incidents, not vendor demo data.

For a wider list of platforms, see our Splunk alternatives guide and SIEM alternatives comparison. For head-to-heads, read SenseOn vs Microsoft Sentinel and SenseOn vs Splunk.

Sources

• Microsoft Learn, Plan costs and understand pricing and billing for Microsoft Sentinel, updated 1 April 2026, accessed 23 September 2026
• Microsoft Learn, Manage data tiers and retention in Microsoft Sentinel, updated 2 July 2026, accessed 23 September 2026
• Microsoft Learn, Create jobs in the Microsoft Sentinel data lake, updated 1 July 2026, accessed 23 September 2026
• Microsoft, Azure Retail Prices API, Sentinel meters, East US, read 23 September 2026
• Splunk, Splunk pricing models, accessed 23 September 2026
• Splunk, Splunk pricing calculator, accessed 23 September 2026
• Splunk, Splunk Cloud Platform service details, updated 6 March 2026, accessed 23 September 2026
• Splunk, Store expired Splunk Cloud Platform data in a Splunk-managed archive, accessed 23 September 2026
• Blake D. Bryant, Hossein Saiedian, "Improving SIEM alert metadata aggregation with a novel kill-chain based classification model", Computers & Security, 2020, https://doi.org/10.1016/j.cose.2020.101817
• Bushra A. Alahmadi, Louise Axon, Ivan Martinovic, "99% False Positives: A Qualitative Study of SOC Analysts' Perspectives on Security Alarms", USENIX Security Symposium, 2022, https://www.usenix.org/conference/usenixsecurity22/presentation/alahmadi (open access)
• NIST, SP 800-92: Guide to Computer Security Log Management, September 2006, accessed 23 September 2026
• MITRE, ATT&CK Command and Control, TA0011, accessed 23 September 2026

How SenseOn writes, checks and corrects its content: editorial standards.

Frequently asked questions

Which is cheaper, Microsoft Sentinel or Splunk?

It depends on your volume and estate, and Splunk publishes no list price, so you need a quote to compare. Sentinel's East US list price on 23 September 2026 was $4.30 per GB pay-as-you-go, falling to $2.96 per GB on the 100 GB a day commitment tier, with 90 days of retention included and free allowances for Microsoft 365 E5 data. Splunk Cloud Platform is sold mainly on compute capacity, measured in Splunk Virtual Compute units, or by exception on GB a day. Ask Splunk for both, and compare them against Microsoft's list price for the same sources and retention.

Is Microsoft Sentinel's data lake a cheaper alternative to Splunk?

It is cheaper storage, but not cheaper detection. Lake ingestion and processing cost about $0.15 per GB at East US list prices, against $4.30 per GB on the analytics tier. Microsoft says lake data "isn't available for real-time analytics features and threat hunting". To detect on it you build scheduled KQL jobs or summary rules and promote the results to the analytics tier.

What is a Splunk SVC?

A Splunk Virtual Compute unit. Splunk defines it as "a unit of capabilities in Splunk Cloud Platform that includes compute, memory, and I/O resources". Splunk Cloud subscriptions are workload-based by default and sized in SVCs, which do not meter ingestion; ingest-based subscriptions are the exception.

How is SenseOn priced compared with Sentinel and Splunk?

SenseOn has no per-GB ingestion charge. It is priced as an annual pool of Flex Intelligence Credits. Edge processing, three-pipeline routing configured by Weave with storage separated from compute, and pricing on compressed storage volume together cut costs by about 40% against a traditional SIEM. The price also covers the AI agents that investigate cases, charged on their activity, with no charge when a case is handed to a person.

Can SenseOn run alongside Sentinel or Splunk?

Yes. SenseOn deploys alongside your existing SIEM and EDR, so you can run it next to Sentinel or Splunk for a 14 to 28 day proof window and compare detections and case volume on your own data before you change anything.