Microsoft Sentinel vs Splunk on the SIEM capacity that follows the logs
Azure analytics GB tiers beside Splunk ingest and SVC capacity, when the SOC invoice tracks data and compute rather than named analyst licenses.
A SOC that budgets for named analyst licenses while the invoice meters gigabytes spends the first quarter explaining overages instead of tuning detections. The failure mode is not missing a query language. It is buying a SIEM whose public meter does not match how telemetry actually arrives.
Buy Microsoft Sentinel when SIEM should sit on Azure analytics with published GB tiers. Buy Splunk when the SOC needs ingest- or SVC-capacity enterprise TDIR outside a Microsoft-only stack.
Overview
| Primary use case | Cloud SIEM on Azure Monitor Log Analytics for security analytics, incidents, and automation against telemetry in Analytics and data lake tiers | Splunk Enterprise Security on Splunk Cloud Platform or Splunk Enterprise for threat detection, investigation, and response, with SIEM plus optional SOAR and UEBA on Premier |
|---|---|---|
| Day-to-day workflow | Connect sources into Log Analytics tables, author scheduled analytics rules in KQL, triage incidents, and visualize with workbooks and playbook automation | Ingest into Splunk indexes, run correlation and notable-event workflows in Enterprise Security, prioritize with risk-based alerting, and extend with Detection Studio and SOAR where licensed |
| Main buying consideration | Analytics pay-as-you-go is USD 4.30 per GB in East US on Azure Retail Prices for Sentinel Analysis; a 100 GB/day commitment is USD 296 per day in the same region, with other daily GB commitments published on the pricing page | Public Splunk pricing pages are quote-only. Splunk Cloud Platform and Enterprise Security meter ingest GB/day or SVC workload capacity; Splunk Observability Cloud meters entities separately and is not the ES SIEM meter |
We reviewed the Microsoft Sentinel pricing page and East US Azure Retail Prices for Analytics pay-as-you-go and commitment meters, Microsoft Learn billing and analytics-rule documentation for Log Analytics workspace enablement and KQL detections, Splunk pricing models and Security Pricing FAQ pages for ingest versus SVC versus entity metering, and the Splunk Enterprise Security product page for Essentials and Premier edition scope, on 7 Oct 2026.
Microsoft Sentinel
Splunk
Editions and metering
Both vendors meter security analytics by capacity rather than by named analyst licenses on the public materials reviewed. Sentinel prints Analytics GB rates and daily commitments. Splunk documents ingest and SVC options and keeps dollars on a quote path for Enterprise Security.
| How capacity is sold | Analytics tier pay-as-you-go or commitment tiers that reserve daily ingestion for analysis. Commitment language on the pricing page covers 100 GB to 50,000 GB per day, with a 50 GB commitment tier in public preview promotional pricing from 1 Oct 2025 through 31 Dec 2026. Data lake tier uses separate ingestion, processing, storage, and query meters on Learn billing docs | Splunk Cloud Platform and Splunk Enterprise offer ingest pricing by GB and workload pricing by SVC (Cloud) or vCPU (Enterprise). Enterprise Security is sold as Essentials or Premier editions on a Get a quote path. Entity pricing applies to Splunk Observability Cloud, not as a substitute for the ES SIEM entitlement |
|---|---|---|
| Figure on the public meter | USD 4.30 per GB for Pay-as-you-go Analysis in East US and USD 296 per day for the 100 GB Commitment Tier Capacity Reservation in East US on Azure Retail Prices checked 7 Oct 2026. Other commitment daily fees scale with reserved GB. Region, currency, and agreement change the invoice | No public USD list rate for Splunk Cloud Platform or Enterprise Security appears on the Splunk pricing models page reviewed. Security Pricing FAQ states ES Cloud needs a Splunk Cloud license and directs buyers to request pricing for ingest or workload options |
| What the listing adds about commitment | Pricing page states commitment tiers can save up to 52% versus pay-as-you-go, can be upgraded anytime, and can be downgraded after 31 days, with overage billed at the selected tier effective rate. Learn documents a 31-day trial with the first 10 GB/day Analytics free, subject to a 20 workspace limit per tenant | Workload FAQ language describes SVC as cloud compute, memory, and I/O driven by search and indexing. Cloud Platform service details describe SVC allocation tied to licensed peak daily ingest on ingest plans, with incremental SVC when Enterprise Security is purchased. Annual cloud subscriptions and on-prem term licenses are named without printed dollars |
Detection and investigation
Shared surface starts with ingesting security telemetry, correlating events, and opening investigations for analysts. The documented split is Azure Log Analytics plus KQL analytics rules versus Splunk indexes plus Enterprise Security notable-event and risk workflows.
| Detection authoring | Scheduled analytics rules run KQL against Log Analytics tables or ASIM parsers, with lookback, threshold, entity mapping, and incident grouping documented on Microsoft Learn | Enterprise Security correlation searches produce notable events. Detection Studio is listed on Essentials and Premier for building, testing, and mapping detections, including MITRE ATT&CK coverage language on the product page |
|---|---|---|
| Investigation surface | Incidents, entity pages, workbooks, and hunting queries in the Sentinel experience (Azure portal today, with Microsoft documenting a move toward the Microsoft Defender portal). Automation uses playbooks and Logic Apps billed as related Azure services | Risk-based alerting, adaptive response, and investigation workflows inside Enterprise Security. Premier adds SOAR automation and UEBA behavioral analytics on the purchasing table. AI Assistant is listed where available |
| Data onboarding | Data connectors land sources in Log Analytics tables. Learn lists free data types such as Azure Activity, selected Office 365 audit tables, and many SecurityAlert streams, while raw logs for several Defender products remain paid | Forwarders, modular inputs, and integrations feed Splunk indexes on Cloud Platform or Enterprise. Federated Search and Federated Analytics are named for data that stays outside the primary index set. Ingest plans meter GB; workload plans emphasize SVC without an ingest ceiling in the pricing-model copy |
Platform footprint
Both products can be the SOC system of record for security telemetry. The documented difference is whether that record sits on Azure analytics meters with Microsoft Defender adjacency, or on Splunk Cloud Platform or Splunk Enterprise capacity metered by ingest or SVC.
| Hosting and control plane | Enabled on an Azure Monitor Log Analytics workspace. Billing can appear as unified Sentinel meters on simplified tiers. Microsoft documents that after 31 March 2027 Sentinel in the Azure portal redirects to the Microsoft Defender portal experience | Splunk Cloud Platform is the hosted control plane; Splunk Enterprise covers private cloud or on-premises. Enterprise Security requires a Splunk Cloud license when bought in the cloud, per the Security Pricing FAQ |
|---|---|---|
| Security edition packaging | Sentinel is the SIEM product. Adjacent Microsoft Defender XDR workloads and Security Copilot / SCU meters are separate Azure or Microsoft 365 entitlements when used. This page does not treat Defender XDR as included Sentinel capacity | Enterprise Security Essentials covers SIEM, threat intelligence, Detection Studio, Exposure Analytics, and AI features listed on the purchasing table. Premier adds SOAR, UEBA, and Automated Threat Analysis. Observability Cloud remains a separate entity-priced product line |
| Where multi-cloud data fits | Connectors bring non-Azure sources into the same workspace, still billed under Sentinel analytics or data lake meters once ingested. The public rate card remains the Azure Sentinel meters for that workspace region | Platform messaging emphasizes multi-domain and multi-cloud data under one Splunk entitlement model (ingest or SVC) |
Favor Microsoft Sentinel when the documented requirement is Azure Log Analytics analytics-tier GB pay-as-you-go or daily commitments with KQL analytics rules and connectors. Favor Splunk when the documented requirement is Splunk Cloud Platform or Enterprise capacity metered by ingest or SVC, with Enterprise Security Essentials or Premier as the TDIR edition on that platform.
FAQs
Does Splunk publish a USD list price for Enterprise Security?
Not on the pricing models page or Enterprise Security purchasing table reviewed on 7 Oct 2026. Those pages describe ingest, workload (SVC), and entity models and point buyers to Get a quote or contact sales for ES dollars.
What does the USD 4.30 Microsoft Sentinel figure include?
On Azure Retail Prices for East US checked 7 Oct 2026, USD 4.30 is per GB for Pay-as-you-go Analysis on the Sentinel product. It is not a commitment-tier daily fee, not a data lake-only meter, and not a Microsoft 365 E5 per-user license price. Region and agreement change the invoice.
What does the USD 296 figure include?
USD 296 per day is the East US retail meter for the 100 GB Commitment Tier Capacity Reservation on Sentinel. It reserves 100 GB/day of analytics-tier capacity. Other commitment sizes have different daily fees on the same price list.
Is Splunk Observability Cloud the same purchase as Enterprise Security?
No. Pricing models list entity pricing for Splunk Observability Cloud and AppDynamics. Enterprise Security is the security TDIR edition sold against Splunk Cloud Platform or Splunk Enterprise capacity (ingest or SVC).
Do both products support SIEM-style correlation on security logs?
Yes. Exclusive contrasts on this page start from that shared surface, then split on published Azure Analytics GB commitments versus Splunk ingest or SVC quotes and Enterprise Security edition packaging.
