What Drives SOC Cost? A UAE Buyer's Guide

SOC cost comes down to four things: how much log data you send for analysis, how long you keep it, which hours analysts watch it, and how much response work the provider takes on. The operating model you choose then decides which of those you pay for directly and which sit inside someone else's fee. This guide explains each driver and gives no figures, because a SOC price quoted without your data sources, retention period and coverage hours is a guess. Use it to scope your needs before you ask for quotes. See how we scope SOC as a service in Dubai.

What are you paying for in a SOC?

You are paying for five things: a platform that stores and analyses your logs, analyst time, detection engineering, incident response and reporting. Every quote splits them differently, so name each one before you compare.

• Platform and data. The SIEM, such as Microsoft Sentinel, and the log data it holds. Logs are how a SOC sees what happens in your systems: joint international guidance published by CISA says event logging improves the security and resilience of critical systems by enabling network visibility.
• Analyst time. People who triage, investigate and escalate alerts. The hours they cover set this cost.
• Detection engineering. Writing and tuning analytics rules so analysts see real threats instead of noise. Without it, more data only means more alerts.
• Incident response. What happens after a confirmed threat: advice only, or hands-on containment such as isolating a device or disabling an account.
• Reporting. What was detected and handled, in a form auditors can use.

The platform brings costs beyond the SIEM itself. Microsoft notes that Sentinel is only a portion of your Azure bill, that linked services such as Logic Apps automation might have extra charges, and that data connectors built on Azure Functions carry a separate cost.

How does log volume change the cost of Microsoft Sentinel?

Log volume drives the platform cost, because the Sentinel analytics tier is billed on the volume of data you send to it, measured in gigabytes, not on headcount. Two choices and one exception shape that bill.

• Pay-as-you-go or a commitment tier. Pay-as-you-go is the default and is based on the data volume actually stored. Commitment tiers bill a fixed daily volume at a discounted rate, start at 100 GB a day, and can only be lowered every 31 days, so they suit organisations with steady, high volumes.
• Analytics tier or data lake tier. The analytics tier supports real-time detection. The data lake tier is charged separately for ingestion, processing, storage and queries, and Microsoft positions it for high-volume, low-value logs.
• Data that carries no charge. Microsoft lists sources Sentinel does not charge for, including Azure Activity logs, Office 365 audit logs and security alerts from the Microsoft Defender products. The raw logs behind some of those products, and some Microsoft Entra ID data types, are charged.

In practice, the sources you connect decide the bill. Devices that send CEF logs deserve a close look, because Microsoft notes that fields beyond the standard CEF schema can carry higher ingestion volumes. Plan connectors source by source; our page on Sentinel data connectors covers what to check.

How long should you keep SOC logs, and what does retention cost?

Keep data in the analytics tier only as long as detection and investigation need it, and move older data to cheaper storage. After volume, retention is the next lever on the platform bill.

• Microsoft says you can retain data ingested into a Sentinel workspace at no charge for the first 90 days, and retention beyond 90 days is charged at standard Log Analytics retention prices.
• Analytics retention can be extended to up to two years, and total retention in the data lake to up to 12 years.
• Data lake storage is charged per GB per month once data leaves analytics retention, at a uniform 6:1 compression rate, so 600 GB of raw data is billed as 100 GB.
• Retention can be set for individual data types, so sign-in and alert data can stay longer than verbose diagnostic logs.

Set the periods from your legal, contractual and audit obligations, and expect each quote to state retention per table.

How do coverage hours change the price?

Coverage hours set the people cost, because every hour the alert queue is watched needs a trained analyst on shift. The usual options are:

• Business hours only. Alerts that fire at night or at the weekend wait for the next shift unless something escalates them.
• Business hours plus on-call. Analysts watch the queue by day, and an engineer is called out for critical alerts.
• Continuous coverage. Analysts on shift through nights, weekends and public holidays. It needs enough people to fill every shift and cover leave, sickness and training, so it costs the most.

Ask every provider to write its hours per priority, not as a single promise. That is how our own packages work. P1 incidents get a 5 minute response, 24/7, on every package. P2 (10 minutes) and P3 (30 minutes) run in support hours by default: Monday to Friday 9:00 to 18:00 and Saturday 9:00 to 14:00. P2 and P3 are covered 24/7 on GR IT AMC Scale and GR Managed IT Professional, and set in the contract on GR Managed IT Enterprise.

How do in-house, MSSP and SOC-as-a-Service costs differ?

They differ in which costs you carry directly and which sit inside a provider's fee.

• In-house SOC. You carry salaries, hiring, training and shift cover, plus the SIEM, tooling and detection content. You get the most control, and every fixed cost is yours.
• MSSP. The provider may monitor you from its own platform and fold platform, data and analysts into one fee. It is simple to buy, but your logs, rules and history may stay on its platform when you leave.
• SOC-as-a-Service on your own Sentinel. Analysts work in a SIEM inside your own tenant. Platform consumption appears on your Azure bill, where you can see it, and the service fee covers people and process. If the contract says so, your data and detection rules stay in your tenant when you change provider.
• Co-managed. Your team covers some hours or tasks and a provider covers the rest. Costs split along the same line, so write the boundary down.

For when each model fits, read our guide to SOCaaS vs MSSP vs in-house SOC.

How can you cut SOC cost without losing coverage?

Cut the data you do not need, not the detections you do. Microsoft documents these levers:

• Filter at the source. Data collection rules let the Azure Monitor Agent filter Windows security events at the source and ingest only the events you select.
• Move secondary data to the data lake. Microsoft says the data lake offers ingestion and storage at a significantly reduced cost for data not needed for real-time detection. Check first: moving a table from the analytics tier to the data lake stops the real-time analytics and hunting queries that use it.
• Find tables no detection uses. SOC optimisation recommendations in Sentinel identify tables with low usage that are not being used for detections. Our page on Sentinel SOC optimisation explains what they show.
• Keep non-security data out. Sentinel analyses all the data in a Sentinel-enabled workspace, so Microsoft advises a separate workspace for operational data.
• Match the commitment tier to real volume. You can raise a tier at any time; moving down waits until the 31-day commitment period ends.
• Choose data types per connector. Where a connector offers both charged and uncharged data types, enable only the ones your detections use.
• Set budgets and alerts. Azure Cost Management budgets can alert people to spending anomalies, and the Workspace Usage Report workbook shows volume per table.

What should a SOC quote include so you can compare it?

A comparable quote names the data sources, retention, hours, response authority, reporting and exit terms. If one is missing, ask for it in writing before you compare.

• Data sources. Every source to be connected, with an estimated daily volume, and which ones carry no Sentinel charge.
• Retention. Analytics and total retention per table, and the reason for each period.
• Platform costs. Whose bill the SIEM, automation and connectors sit on, and how changes in volume are handled.
• Coverage hours. Hours per priority, and who is on call outside them.
• Response authority. Whether analysts can isolate a device or disable an account, or only advise your team. NIST's 2025 incident response guidance builds response into an organisation's wider cyber risk management, so agree who decides what before an incident.
• Escalation. Who is told, and when. On our IT AMC packages, for example, a service manager is notified of a P1 within 30 minutes and a director is briefed within 1 hour.
• Reporting. What each monthly report contains. On the same packages, every missed target is listed with the ticket, the time it took and the reason.
• Exit and data ownership. Where the workspace, logs and detection rules live, which Azure region holds them, who owns them, and how access is handed back.

Our Dubai-based SOC runs Microsoft Sentinel for more than 50 client tenants. If you want a quote built on this list, send your data sources, retention needs and the hours you want covered through our contact page. If you are still deciding whether you need a SOC at all, start with what a SOC does.