Who does what
Provider
- Operate Sentinel monitoring and detections
- Implement contracted content changes
- Investigate incidents and recommend action
Your team
- Select and request content changes
- Maintain Microsoft prerequisites and sources
- Contain incidents and restore systems
Details
Service scope
Best for Microsoft teams keeping an internal response function
Tier boundary
Foundation and Foundation Plus are Managed Sentinel tiers. Premium adds XDR and agreed remediation actions. Confirm the tier before assigning response ownership.
Tenant and sources
Sentinel runs in your Azure tenant. Existing workspaces need a migration assessment. Only agreed data sources are in scope.
Shared detection operation
BT implements requested content changes within tier allowances. Your team chooses changes and acts on service-review findings.
Full service analysis
BT Managed Sentinel operates agreed detection content in your Sentinel environment, implements requested content changes and investigates incidents in the Foundation and Foundation Plus tiers. Your team chooses content changes, maintains sources and handles containment and recovery, with Premium XDR response scoped separately.
- Your team owns
- Select content changes and participate in the agreed review process
- Microsoft licensing and tenant prerequisites
- Agreed log-source configuration and connectivity
- Containment, remediation and recovery in the advisory scope
Price comparison
The G-Cloud listing and its May 2024 price card do not provide a consistent single starting price. Obtain an itemized current quote for your ingestion band and service tier.
Processing locations
Confirm contractual processing locations for logs and support data. The procurement listing names the UK while its service definition also describes EEA processing.
Shared detection operation
BT implements requested changes to the custom detection content in your Sentinel environment within the tier allowance. Your team supplies change instructions and acts on review findings. This recurring platform work is separate from the advisory incident response in Foundation and Foundation Plus.
Pricing & contract
- Billing
- Custom
Request separate setup, monthly service, Microsoft licensing, ingestion and retention costs for Foundation or Foundation Plus. Public G-Cloud and marketplace figures use different packages and units, so they are not a single current starting price.
Tradeoffs & buying questions
Strengths
-
Focused Microsoft Sentinel operation
-
Detection maintenance and incident advice
-
Customer retains response decisions
Considerations
-
Response ownership changes with tier
-
Log-source and licensing work stays with the buyer
-
Setup and recurring charges need separate comparison
-
Content changes have tier allowances and may incur extra charges
Ask before buying
- Which tier and response actions are in the order?
- Which log sources, detections and change allowances are included?
- Reconcile the G-Cloud listing and price card, including setup, monthly service and Microsoft costs.
Integrations
Platform / SIEM
- Microsoft Sentinel
Cloud
- Azure
Other integrations
- Microsoft 365 Defender incident integration
- CEF
- Syslog
Common questions
Does BT take containment actions?
Foundation and Foundation Plus provide incident advice alongside shared Sentinel operation. Premium XDR adds agreed remediation actions under configured permissions.
Can BT use our existing Sentinel workspace?
BT describes a migration assessment for existing workspaces. Confirm the work required before signing.
Is the G-Cloud headline the full price?
Request an itemized quote. The linked price card separates setup and monthly ingestion-band charges, and Microsoft costs need separate confirmation.