Powerful, and the bill will teach you data discipline

Sentinel gave us a SIEM without a hardware refresh and KQL is a pleasure once it clicks. The lesson was ingestion cost: our first full month was double the estimate because we piped in everything. We now split tables between analytics and basic logs, and we drop what we cannot articulate a detection use for. That discipline is healthy, but you should arrive expecting it rather than discovering it on an invoice.