Ongoing project: Due to its scope, this project is still being updated. Content on this page may change as work continues.
The Problem
In March–April 2026, leadership decided that renewing the on-premises SolarWinds SIEM cost too much. They asked me to research moving the same setup to Microsoft Sentinel. My research showed roughly 63-70% lower annual cost, and the migration was approved.
A Sentinel workspace already existed, but it was immature: it ingested only Entra sign-in logs. Before it could replace the legacy SIEM, it needed the same log sources and the same detections as SolarWinds.
What I Built
- An inventory of every SolarWinds rule and every system sending it data, used as the migration plan
- Security log ingestion from domain controllers and other critical servers through Azure Arc, the Azure Monitor Agent (AMA), and Data Collection Rules (DCRs)
- A hardened Linux server that forwards switch and firewall syslog into Sentinel through the same Arc/AMA path
- About 30 SolarWinds rules rebuilt 1:1 as custom KQL analytic rules, with Logic Apps sending email alerts
- A later set of 50 baseline detections for a regulated environment, mapped to MITRE ATT&CK
- About 14 data connectors, plus SOAR automation built from automation rules and Logic Apps
How It Works
I delivered the project in three phases, each covered in its own writeup:
- SolarWinds to Sentinel: 1:1 Migration: rebuilt the legacy rule set and log sources in Sentinel, then ran both SIEMs side by side for about a month.
- Sentinel Detection Engineering Coming Soon: built 50 baseline detections from threat intelligence research, mapped to MITRE ATT&CK and tuned against real alert volume.
- Sentinel Ingestion & SOAR Automation Coming Soon: expanded ingestion to about 14 connectors and automated incident handling with automation rules and Logic Apps.
Impact
- Roughly 63-70% lower annual cost than renewing the legacy SIEM
- About 30 legacy rules migrated at 1:1 parity for easy auditing
- 50 baseline detections, now implemented as 90+ analytic rules
- About 14 data connectors feeding Sentinel
- SOAR automation for incident assignment, ticket creation, email alerts, enrichment, and partial remediation
Current State
The Sentinel deployment is now mature. Every detection that has fired so far has been a credential-compromise event, and layered (defense-in-depth) controls mitigated each one. All custom KQL is saved in the Sentinel query library, and I use it to train junior staff in a recurring knowledge-sharing meeting. The platform will keep evolving as the organization moves to E5.