Case study · Financial Services · London, UK
ITSECOPS deployed Microsoft Sentinel for a 2,000-employee London financial services group: log onboarding, MITRE ATT&CK-mapped detections, Microsoft Defender integration and cost-controlled ingestion — feeding a 24×7 monitoring workflow.
The client
A financial services group headquartered in London with 2,000 staff, a Microsoft-heavy estate and an audit finding that security logging was fragmented across consoles.
The challenge
Logs everywhere, correlation nowhere. The group needed a SIEM that its auditors would respect and its budget could survive — Sentinel ingestion costs can spiral without deliberate design.
What we did
- Onboarded the sources that matter first: Entra ID sign-ins, Microsoft 365, Defender for Endpoint and Identity, firewalls and VPN.
- Built analytics rules mapped to MITRE ATT&CK techniques, tuned against two weeks of baseline noise before go-live.
- Configured the Defender XDR integration so incidents arrive correlated, not as duplicate alerts.
- Engineered ingestion cost controls: data-collection rules to filter verbose sources, basic-logs tiering for low-value telemetry, and workbook-level cost visibility.
- Documented triage runbooks aligned to our 24×7 SOC escalation model.
Results
- Single pane for 2,000 users’ security telemetry with ATT&CK coverage mapping.
- Ingestion costs held predictable via DCR filtering and tiering.
- Audit finding closed at the next review cycle.
FAQ
How do you keep Microsoft Sentinel costs under control?
Filter at the data-collection rule, tier low-value logs to basic, and review ingestion weekly for the first quarter. Cost discipline is a design input, not an afterthought.
Does Sentinel replace Microsoft Defender?
No — Defender detects on endpoints and identities; Sentinel correlates across everything and adds retention, hunting and SOAR. They are designed to work together.
How long does a Sentinel rollout take for 2,000 users?
Expect 6–10 weeks to tuned production: connectors are fast, tuning and runbooks are the real work.