Sentinel vs Splunk vs SenseOn: SIEM Cost and Detection Compared

Microsoft Sentinel, Splunk and SenseOn all detect threats in security data, but they charge for it in three different ways. Sentinel bills mainly per gigabyte ingested into its analytics tier. Splunk sells compute capacity (workload pricing, measured in Splunk Virtual Compute units) or ingest volume, and publishes no list price. SenseOn prices on outcomes, with data volume as one meter, not the whole bill; humans and its AI agents can search and hunt across the Observability and Compliance pipelines, for as long as you keep your data, with no restore step. If your SIEM bill is forcing you to choose which logs get watched, that difference matters more than any feature list.

This comparison uses only each vendor's own documentation and pricing pages, read on 23 September 2026, plus peer-reviewed research where it helps. Where a vendor does not publish a figure, we say so rather than estimate it.

Sentinel vs Splunk vs SenseOn at a glance

Sources: Microsoft Learn and the Azure Retail Prices API; Splunk pricing pages and Splunk Cloud Platform service details; SenseOn product pages. All read 23 September 2026.

How each one charges you

Microsoft Sentinel: per GB, with a cheaper tier that trades away detection

Microsoft's billing documentation says pricing "is based on the tier that the data is ingested into". At the East US list price on 23 September 2026, analytics ingestion was $4.30 per GB pay-as-you-go. Daily commitment tiers lower the effective rate, from $2.96 per GB at 100 GB a day. Analytics data is retained free for 90 days. Microsoft 365 E5, A5, F5 and G5 customers get up to 5 MB per user per day of eligible Microsoft data free.

The data lake tier costs about $0.15 per GB to bring data in ($0.05 ingestion plus $0.10 processing). The catch is in Microsoft's own tier comparison: lake data "isn't available for real-time analytics features and threat hunting". Our Microsoft Sentinel pricing guide works through three monthly bills and the limits on detecting over lake data.

Splunk: capacity or volume, and no public price

Splunk's pricing models page lists ingest pricing ("based on gigabytes of data ingested"), workload pricing ("based on the amount of compute and storage resources required to run search and analytics workloads") and, for Splunk Cloud Platform, activity-based pricing, "a dual-meter pricing model based on both ingest and search activity". Splunk's Cloud Platform service details (updated 6 March 2026) say a subscription "is workload-based and is sized for resource capacity. By exception, you may be on an ingest-based subscription that is sized for data volume ingested."

A Splunk Virtual Compute (SVC) is, in Splunk's words, "a unit of capabilities in Splunk Cloud Platform that includes compute, memory, and I/O resources". Workload subscriptions "do not meter ingestion", so you can raise ingest or search load until the SVCs are fully used. On an ingest subscription you can exceed your purchased daily volume "a maximum of five times in a calendar month".

Splunk does not publish a price for Splunk Cloud Platform or Enterprise Security. Its own pricing calculator estimates SVCs from your daily GB, not dollars. Ask for your quote in both workload and ingest terms so you can compare them. Our Splunk pricing guide explains each unit and what to ask for.

SenseOn: priced on outcomes, and three ways the cost comes down

SenseOn is priced as an annual pool of Flex Intelligence Credits. You pay for outcomes: detection and response across your data, analytics included, and the investigations its AI completes. Data volume is one meter, not the whole bill. Three things bring the cost down:

1. Edge processing removes unnecessary data before it reaches the pipeline.
2. Three-pipeline routing, configured by Weave, SenseOn's security engineering agent, sends each source down the right pipeline, with storage separated from compute.
3. Compression, with storage priced on the compressed volume.

Together these cut costs by about 40% against a traditional SIEM. The saving on SIEM costs alone would be larger, because the price also covers SenseOn's Agentic Cybersecurity Team (ACT), the AI agents that investigate and resolve cases. You pay for the investigations the agents complete, not for an MDR service.

Which of your data gets detection?

This is the question per-GB and per-capacity pricing forces on you, and where the three differ most.

Sentinel splits it by tier. Data in the analytics tier gets real-time analytics rules, hunting and workbooks. Data you send to the lake to save money does not. Microsoft is direct: when you move a table from analytics to the lake, "all real-time analytics and hunting queries stop working". To detect on lake data you build KQL jobs or summary rules, promote their results to an analytics-tier table, and run an analytics rule on that. New lake data takes "up to 15 minutes" to become queryable, and a tenant can run 5 jobs at once.

Splunk splits it by what is searchable. Data in searchable storage can be searched and correlated. After your searchable retention ends, data can go to Splunk's managed archive. Splunk's archive documentation says "the restoration process can take up to 24 hours to complete", and the service details say restored data "is searchable for up to 30 days". Data exported to your own cloud storage through Dynamic Data Self-Storage "will no longer be searchable by Splunk Cloud Platform". A hunt that reaches past searchable retention starts with a restore request.

SenseOn does not tie detection to a tier. It detects at three speeds:

• Real time on the endpoint, through the Universal Sensor, which captures endpoint, network and identity telemetry on Windows, macOS and Linux.
• Near real time across every log source you route to Detection & Response, as it streams through SenseOn's message queue.
• Behavioural analytics about every five minutes across every log source you route to Detection & Response.

Data rolls from one tier to the next automatically, and you choose, per source, which pipeline it goes to: Detection & Response for detection, or Observability and Compliance for search and hunting. SenseOn's AI agents run queries and threat hunts across every tier for the whole retention period. Because they are long-running agents rather than a person at a console, a query over older, colder data can take a little longer without anyone waiting on it. There is no restore step.

Why it matters: the sources teams move to cheap storage are the high-volume ones, such as firewall, DNS, proxy and network flow logs. MITRE ATT&CK notes that for command and control, "adversaries commonly attempt to mimic normal, expected traffic to avoid detection". Our judgement: a pricing model that makes you stop watching network logs saves money on exactly the records you need to catch that traffic.

Detection and analyst workload

Sentinel and Splunk both depend on the rules you write and tune, in KQL and SPL respectively. That tuning decides the outcome. Bryant and Saiedian found that re-engineering SIEM correlation rules raised detection rates and cut false positives, and traced much of SIEM's shortfall to insufficient configuration (Computers & Security, 2020). Oxford researchers interviewing SOC analysts found they reported high false positive rates, mostly benign triggers explained by legitimate activity (USENIX Security, 2022).

SenseOn starts from built-in detection instead. Its Intelligence Fabric correlates endpoint, network, identity and log evidence into cases, and its AI agents investigate them. About 97% of alert noise is removed before an analyst sees a queue, and 92.5% of incidents are resolved by AI under human governance, measured across all customer environments over a rolling 30-day window. Forge drafts and tests detection changes for a detection engineer to approve, so you can still write your own content.

Where each one fits

Choose Microsoft Sentinel if you run Microsoft 365 E5 and Azure, most of your detection data is Microsoft's own, and your non-Microsoft log volume is modest. The E5 data benefit and free Defender alerts go a long way. Watch the bill as third-party logs grow, and be deliberate about what you send to the lake.

Choose Splunk if you have skilled SPL engineers, years of custom content, and use Splunk beyond security for IT operations or application analytics. Nothing else matches its flexibility for teams that can afford to use it. Model SVC growth and archive restores before renewal.

Choose SenseOn if your SIEM bill is deciding which sources get detection and you want to choose per source instead, your team is too small to spend its week tuning rules, or you want AI agents to do triage and hunting across all your retained data. SenseOn searches and visualises any log, not only security data, so it replaces Splunk's log search as well as its SIEM.

You do not have to switch in one go. SenseOn deploys alongside your existing SIEM and EDR, so you can run it next to Sentinel or Splunk for a 14 to 28 day proof window, compare detections and case volume on your own data, and move high-volume sources off the per-GB or per-SVC bill only where the evidence is clear.

A worked example: 150 GB a day, kept for a year

One environment, priced three ways with our SIEM cost calculator at its default inputs: 150 GB of security data a day, 365 days of retention, US list prices for East US read on 23 September 2026.

The second row is the triage most Sentinel teams make: it saves money by taking half the data out of real-time detection. The SenseOn figure is indicative, not a quote. The saving comes from three levers: edge processing, routing down three pipelines with storage separated from compute, and pricing on the compressed storage volume. Your quote depends on your sources, retention and the agents' investigation work.

How to compare them on your own numbers

Our SIEM cost calculator does the first pass: Sentinel from Microsoft's list prices, your Splunk quote, and an indicative SenseOn figure, with every assumption shown. Then work through these steps.

1. Measure daily volume by source. Split it into data you need for real-time detection and data you keep for audit or forensics. NIST's log management guide, SP 800-92, asks you to set a purpose and retention period for each source.
2. Price Sentinel from Microsoft's list. Pick the commitment tier whose break-even point you clear on most days, then add retention past 90 days and lake meters.
3. Ask Splunk for a quote in both models. Get the SVC count for your search load and the GB-a-day price, plus the archive and restore terms.
4. Ask SenseOn for a credit plan covering the same sources and retention, and what the agents' investigation work adds.
5. Count what each option leaves unwatched. For every source you would move to a cheaper tier, write down whether it still gets real-time detection and hunting.
6. Run a proof on your own data. Run it live alongside your current SIEM for 14 to 28 days, with your top 20 detections and unannounced attack simulations, not vendor demo data.

For a wider list of platforms, see our Splunk alternatives guide and SIEM alternatives comparison. For head-to-heads, read SenseOn vs Microsoft Sentinel and SenseOn vs Splunk.

Sources

• Microsoft Learn, Plan costs and understand pricing and billing for Microsoft Sentinel, updated 1 April 2026, accessed 23 September 2026
• Microsoft Learn, Manage data tiers and retention in Microsoft Sentinel, updated 2 July 2026, accessed 23 September 2026
• Microsoft Learn, Create jobs in the Microsoft Sentinel data lake, updated 1 July 2026, accessed 23 September 2026
• Microsoft, Azure Retail Prices API, Sentinel meters, East US, read 23 September 2026
• Splunk, Splunk pricing models, accessed 23 September 2026
• Splunk, Splunk pricing calculator, accessed 23 September 2026
• Splunk, Splunk Cloud Platform service details, updated 6 March 2026, accessed 23 September 2026
• Splunk, Store expired Splunk Cloud Platform data in a Splunk-managed archive, accessed 23 September 2026
• Blake D. Bryant, Hossein Saiedian, "Improving SIEM alert metadata aggregation with a novel kill-chain based classification model", Computers & Security, 2020, https://doi.org/10.1016/j.cose.2020.101817
• Bushra A. Alahmadi, Louise Axon, Ivan Martinovic, "99% False Positives: A Qualitative Study of SOC Analysts' Perspectives on Security Alarms", USENIX Security Symposium, 2022, https://www.usenix.org/conference/usenixsecurity22/presentation/alahmadi (open access)
• NIST, SP 800-92: Guide to Computer Security Log Management, September 2006, accessed 23 September 2026
• MITRE, ATT&CK Command and Control, TA0011, accessed 23 September 2026

How SenseOn writes, checks and corrects its content: editorial standards.

Frequently asked questions

Which is cheaper, Microsoft Sentinel or Splunk?

It depends on your volume and estate, and Splunk publishes no list price, so you need a quote to compare. Sentinel's East US list price on 23 September 2026 was $4.30 per GB pay-as-you-go, falling to $2.96 per GB on the 100 GB a day commitment tier, with 90 days of retention included and free allowances for Microsoft 365 E5 data. Splunk Cloud Platform is sold mainly on compute capacity, measured in Splunk Virtual Compute units, or by exception on GB a day. Ask Splunk for both, and compare them against Microsoft's list price for the same sources and retention.

Is Microsoft Sentinel's data lake a cheaper alternative to Splunk?

It is cheaper storage, but not cheaper detection. Lake ingestion and processing cost about $0.15 per GB at East US list prices, against $4.30 per GB on the analytics tier. Microsoft says lake data "isn't available for real-time analytics features and threat hunting". To detect on it you build scheduled KQL jobs or summary rules and promote the results to the analytics tier.

What is a Splunk SVC?

A Splunk Virtual Compute unit. Splunk defines it as "a unit of capabilities in Splunk Cloud Platform that includes compute, memory, and I/O resources". Splunk Cloud subscriptions are workload-based by default and sized in SVCs, which do not meter ingestion; ingest-based subscriptions are the exception.

How is SenseOn priced compared with Sentinel and Splunk?

SenseOn is priced as an annual pool of Flex Intelligence Credits. You pay for outcomes: detection and response across your data, analytics included, and the investigations its AI completes. Data volume is one meter, not the whole bill. Edge processing, three-pipeline routing configured by Weave with storage separated from compute, and storage priced on the compressed volume together cut costs by about 40% against a traditional SIEM. The price also covers the investigations its AI agents complete.

Can SenseOn run alongside Sentinel or Splunk?

Yes. SenseOn deploys alongside your existing SIEM and EDR, so you can run it next to Sentinel or Splunk for a 14 to 28 day proof window and compare detections and case volume on your own data before you change anything.