Compare
WitFoo and Microsoft Sentinel
Microsoft publishes Sentinel’s rates. The difficulty is how many separate meters you have to forecast, and the fact that one of them reads every query you run against the data lake tier.
The short answer
Sentinel is an Azure service. You enable it on an Azure Monitor Log Analytics workspace, and it “runs on Azure infrastructure that accrues costs when you deploy new resources”. There is no self-hosted build.
The analytics tier has two ways to pay — pay-as-you-go or a commitment tier — and that is the part most people price out. Underneath it sit more: data lake ingestion, data processing, data lake storage, data lake query, advanced data insights, graph compute, retention past 90 days, Logic Apps for automation, and Azure Functions for some connectors. Each is documented, each has its own rate, and each is a line on the invoice.
WitFoo Analytics has one. $25,000 per appliance per year to start, unlimited data rates, retention included, and no unit that moves when an analyst runs a query. Every tier includes Conductor, so data arrives parsed with no rules to write and enriched by inference.
What WitFoo Analytics adds
What WitFoo Analytics brings to an investigation, at one published price per appliance.
No query meter
An investigation has no marginal cost. Nobody weighs a hunch against a budget, and nobody has to write efficient KQL to protect one.
Conductor in every tier
Every Analytics tier includes a Conductor license, so data arrives parsed with no rules to write, enriched by inference, and, when you choose, with sensitive values replaced by tokens. Pro and Max include Conductor Pro, which adds STIX threat intelligence.
Learn more →Empathetic Processing
What a good listener does, in four steps: understand what each signal says, understand why it was sent, track the relationships signals establish over time, and shape what is said for whoever, or whatever, is listening. Analytics tracks those relationships in a graph, the way a person learns a case rather than memorizing a list.
Learn more →Keeps the Sentinel you have
Put Conductor in front of Sentinel and it delivers structured records into your workspace through its built-in Microsoft Sentinel exporter, deduplicated and enriched. You keep Sentinel and KQL.
Learn more →Runs wherever the data is
On premises, in a hypervisor, on bare metal, or in your own cloud account, including fully air-gapped. Diagnostics and threat-intelligence lookups to WitFoo are on by default and can be switched off or blocked at the network, and the AI assistant can run against a local model.
One number a year ahead
Published prices, one annual fee per appliance, and unlimited data rates in every tier. No commitment tier to size and no second product’s meters underneath.
Learn more →
The two models, question by question
Every Sentinel claim below is quoted from Microsoft’s own billing documentation, with a link. None of them is a price — Azure rates are regional and move, and the third-party trackers already disagree about them. Competitor statements checked 13 October 2026.
How many meters run at once?
WitFoo Analytics
One. An annual fee per appliance covering ingestion, retention, search, and reporting, with unlimited data rates in every tier.
Microsoft Sentinel
The analytics tier is one decision; the data lake tier alone adds five more meters, before graph compute, Logic Apps automation, and Azure Functions connectors.
“Data lake ingestion is charged per GB … Data processing is charged per GB … Data lake storage charges are applied per GB per month … Data lake query charges apply per GB of uncompressed data scanned … Advanced data insights charges apply per compute hour used …”
Does running a query cost money?
WitFoo Analytics
No. There is no query meter, so an investigation has no marginal cost.
Microsoft Sentinel
Against the data lake tier, yes — charged on uncompressed volume scanned, so an imprecise KQL query costs more than a precise one.
“Data lake query charges apply per GB of uncompressed data scanned using Kusto Query Language (KQL) queries or KQL jobs.”
Is retention a separate charge?
WitFoo Analytics
No. Retention is a function of the appliance you bought, not a second meter.
Microsoft Sentinel
Free for 90 days, then charged at Log Analytics retention prices; long-term data in the data lake tier is charged on both volume stored and volume scanned.
“Retain all data ingested into the workspace at no charge for the first 90 days. Retention beyond 90 days is charged per the standard Log Analytics retention prices.”
Can you reduce your commitment if you over-buy?
WitFoo Analytics
There is no commitment to reduce. The license is per appliance, per year.
Microsoft Sentinel
Only on a schedule. Lowering a commitment tier is rate-limited.
“Lowering the Commitment tier is only allowed every 31 days.”
Can it run on infrastructure you own?
WitFoo Analytics
Yes — on premises, in a hypervisor, on bare metal, or in your own cloud account, including fully air-gapped. Diagnostics and threat-intelligence lookups to WitFoo are on by default and can be switched off or blocked at the network, and the AI assistant can run against a local model.
Microsoft Sentinel
No. Sentinel is an Azure service enabled on a Log Analytics workspace. If your environment cannot reach Azure, Sentinel is not an option at any price.
“Microsoft Sentinel runs on Azure infrastructure that accrues costs when you deploy new resources.”
Are raw logs covered?
WitFoo Analytics
Yes. No source, Microsoft or not, is metered: every source your tier integrates is covered by the same annual fee with unlimited data rates.
Microsoft Sentinel
Alerts from Microsoft’s security products are free; Microsoft documents that the raw logs for some of those products are paid.
“Although alerts are free, the raw logs for some Microsoft Defender XDR, Defender for Endpoint/Identity/Office 365/Cloud Apps, Microsoft Entra ID, and Azure Information Protection (AIP) data types are paid.”
What happens when you turn it off?
WitFoo Analytics
The appliance stops costing you anything at renewal. There is nothing else running.
Microsoft Sentinel
Removing Sentinel leaves the workspace behind, along with any separate charges it may be incurring.
“Removing Microsoft Sentinel doesn't remove the Log Analytics workspace Microsoft Sentinel was deployed on, or any separate charges that workspace might be incurring.”
Why teams choose WitFoo Analytics
Or keep the Sentinel you have and put Conductor in front of it.
-
You cannot reach Azure, or you have decided not to. If your environment is cut off from Azure or must stay on premises, Sentinel is not a more expensive option, it is not an option. This is the clearest dividing line between the two products.
-
You want investigation to be free at the margin. No query meter means an imprecise search during an incident costs nothing, and nobody has to write efficient KQL to protect a budget.
-
You want one number a year ahead. One line item per appliance, published, with no tier to right-size, no commitment to ratchet, and no second product’s meters underneath.
-
Your telemetry comes from more than Microsoft. Sentinel’s free data sources are Microsoft’s own, so firewall and Linux logs are paid ingestion. WitFoo licenses every source the same way, with unlimited data rates.
-
You want to keep Sentinel and spend less on it. Conductor sits in front, deduplicates and enriches before the meter reads, and delivers structured records into your workspace through its built-in Microsoft Sentinel exporter.
-
You are buying several appliances, or you are government, nonprofit, or education. Volume discounts apply automatically per product line, and the public-sector discount stacks on the order total.
Questions people actually ask
Can Microsoft Sentinel run on premises?
No. Sentinel is enabled on an Azure Monitor Log Analytics workspace and, in Microsoft’s words, “runs on Azure infrastructure that accrues costs when you deploy new resources”. There is no self-hosted build. For an environment that cannot reach Azure, Sentinel is not a more expensive option — it is not an option. This is the sharpest difference between Sentinel and WitFoo Analytics, which runs on infrastructure you control, including fully air-gapped.
How is Microsoft Sentinel priced?
The analytics tier has two ways to pay: pay-as-you-go, based on data volume, or a commitment tier that reserves daily capacity and starts at 100 GB per day. Beneath that sit further meters — data lake ingestion, data processing, data lake storage, data lake query, advanced data insights, graph compute — plus retention beyond 90 days, Logic Apps for automation, and Azure Functions for some connectors. All are documented by Microsoft, and all are separate line items.
Does Microsoft Sentinel charge for running queries?
Against the data lake tier, yes: “Data lake query charges apply per GB of uncompressed data scanned using Kusto Query Language (KQL) queries or KQL jobs.” Because the meter reads uncompressed volume scanned, a broad query costs more than a narrow one. Queries against the analytics tier are not separately metered. WitFoo Analytics has no query meter at all.
Does WitFoo charge more for non-Microsoft sources?
No. WitFoo Analytics is licensed per appliance with unlimited data rates, whether your telemetry comes from Microsoft, a firewall, or a Linux server.
Can I lower my Sentinel commitment tier if I over-commit?
Yes, but not freely: “Lowering the Commitment tier is only allowed every 31 days.” Raising it is unrestricted. WitFoo has no commitment tier to size.
Can I reduce my Sentinel bill without replacing Sentinel?
Yes. WitFoo Conductor sits in front of Sentinel, deduplicates and enriches on the way in, and delivers structured records into your workspace through its built-in Microsoft Sentinel exporter. You keep Sentinel and KQL, and what reaches the meter is already deduplicated and enriched.
Some SOCs cannot reach the cloud at all.
WitFoo Analytics starts at $25,000 per appliance per year — air-gap capable, with no query meter and an AI assistant that can run against a local model. Or keep Sentinel and put Conductor in front of it.