Sentinel Health Check
Ten business days, Reader access, one workspace. We find what is not being detected and what you are paying to ingest for nothing.
- Duration
- 10 business days
- Price
- From $2,500 per workspace
- Access
- Reader access.
Engagement, 10 business days: day 0, access; days 1 to 8, review in your tenant; day 9, report; day 10, walkthrough; then the next 30 days, plan executed by your team or by us.
What we review
- Connectors and ingestion health.
- Ingestion cost by table and source, unused data.
- Analytic rules (MITRE coverage, false positives, disabled rules).
- Automation rules and playbooks.
- Workbooks.
- Retention.
- Defender XDR integration.
- Identity signal coverage.
What you get
The same report, plan and walkthrough as the Falcon Health Check, plus an ingestion cost savings estimate in dollars per month.
Example report page, section 4, Ingestion and cost: five findings, S-11 to S-15, covering unused tables, missing DCR filters, Basic logs candidates, duplicate connectors and retention over policy.
- Access
- Reader access.
- Price
- $2,500 per workspace. Three: $6,000.