Compare / Sentinel vs Chronicle

Microsoft Sentinel vs Google Chronicle cost: 2026 comparison

Head-to-head cost comparison. Per-GB Sentinel versus Chronicle's GB data-cap pricing at five log-volume bands, five-year TCO model, and where Microsoft 365 free ingest and bundled Mandiant intelligence decide the winner. Chronicle priced from Google's own G-Cloud 15 list; Sentinel rates verified against the Azure retail price list. Updated October 2026.

Page updated 13 October 2026/First published 15 May 2026

Sentinel

Per-GB

Plus free MS365 ingest

Chronicle

GB data cap

$2.40/GB/yr Enterprise list ($43.8K at 50 GB/day)

Both meter volume

Chronicle lower at list

5-20% below Sentinel from 50 GB/day up

Decider

MS365 vs Mandiant

Free ingest vs bundled intel

Per-GB versus GB data cap: how the meters collide

Sentinel and Chronicle both price on data volume, though through different mechanisms. Sentinel meters per gigabyte ingested with commitment-tier discounts, plus structural free ingest of Microsoft 365 and Azure native log sources. Chronicle (now Google SecOps) prices on a GB data cap sold in annual packages (Standard, Enterprise, Enterprise Plus), with Google's filed list at $2.40 per GB per year on Enterprise ($1.95 Standard, $4.60 Enterprise Plus), which works out to about $43.8K at 50 GB per day on Enterprise. Chronicle is not metered per employee: the data-cap package is the meter, though Google sizes the bundled cap generously relative to a customer's seat count, which is why organisations with high log volume per employee find Chronicle cheap. Because both vendors ultimately track data volume, their costs land close together across most volume bands.

The old rule of thumb that a per-employee meter beats per-GB above some log-volume threshold no longer holds, because Chronicle's cost also rises with data volume. At 50 GB per day Chronicle Enterprise lists at about $43.8K against Sentinel's $55K to $78K; at 200 GB per day about $175.2K against Sentinel's $200K; at 500 GB per day $438K against $462K. At list Chronicle Enterprise sits 5 to 20 percent below Sentinel from 50 GB per day upward, and the gaps are further moved by two real factors rather than by headcount: Sentinel's free Microsoft 365 ingest, and Chronicle's bundled Mandiant threat intelligence.

The first tie-breaker is Microsoft 365 share of total log volume. In Microsoft-heavy estates where 30 to 60 percent of ingest is Microsoft 365, Sentinel does not pay for that portion at all, which can pull Sentinel below Chronicle even where the raw volume comparison favours Chronicle. The second is the Mandiant bundle: Chronicle Enterprise includes Mandiant threat intelligence and Enterprise Plus adds Mandiant Hunt, capabilities that cost Sentinel customers a separate Mandiant Advantage subscription. The third is data-cap sizing: because Chronicle packages a fixed annual data cap, an organisation whose log volume runs high relative to its licensed cap extracts strong value, while an organisation that under-uses its cap overpays. The buying decision turns on these factors and on platform ecosystem, not on employee count.

Same environment, both vendors

Profile	Sentinel (30% free share to PAYG)	Chronicle data cap	Winner	Note
5 GB/day	$5.5K-$7.8K	$4.4K	Chronicle at list	Tiny volumes; deal minimums, not list rates, usually set the floor
50 GB/day	$55K-$78K	$43.8K	Chronicle	Sentinel MS365 free ingest narrows the gap
200 GB/day	$200K	$175.2K	Chronicle by ~12%	Both track volume; Mandiant bundle can tip Chronicle further
500 GB/day	$462K	$438K	Chronicle narrowly	About 5% apart on data volume alone
1,000 GB/day	$905K	$876K	Chronicle narrowly	Sentinel EA discounts and Chronicle negotiated discounts set the real number

Annual ranges, before negotiated multi-year discounts. Sentinel ranges run from a 30 percent Microsoft 365 free-ingest share (low end) to zero free share at PAYG (high end). Sentinel figures from the Azure retail price list (East US, read 13 October 2026: $4.30/GB pay-as-you-go; 50, 200, 500 and 1,000 GB/day commitment tiers at $161.25, $548, $1,265 and $2,480 per day). Chronicle figures are GB/day x 365 x $2.40, the Enterprise list price per GB per year in Google Cloud EMEA's own UK G-Cloud 15 pricing document (Standard is $1.95, Enterprise Plus $4.60). Both are list prices before negotiated discount.

Five-year TCO at 200 GB per day

Year	Sentinel	Chronicle data cap
Year 1 (200 GB/day)	$200K (200 GB commitment tier)	$175.2K (Enterprise list)
Year 2	$200K	$175.2K
Year 3	$200K	$175.2K
Year 4	$200K	$175.2K
Year 5	$200K	$175.2K
5-year total	$1.0M	$876K

At 200 GB per day the two land about 12 percent apart at list, both held flat at today's list price for five years (no growth, inflation or renewal discount assumed). Because Chronicle meters a GB data cap rather than headcount, the comparison tracks volume across the board; the tie-breakers are Microsoft 365 free ingest and Chronicle's bundled Mandiant intelligence. Excludes one-time migration costs.

When Sentinel genuinely wins

+Microsoft 365 and Azure-heavy environments where free Microsoft ingest is the dominant log source and structurally lowers Sentinel's billable volume
+Organisations consolidating onto Microsoft Defender, Defender for Endpoint, and Defender for Cloud where Sentinel bundling compounds across the stack
+Organisations that under-use a Chronicle data-cap package, where paying per-GB on Sentinel beats paying for unused capped capacity
+Customers needing Azure-native data residency or sovereignty controls that Sentinel satisfies more flexibly than Google SecOps
+Cloud-native deployments where Azure-native SIEM operational simplicity outweighs Chronicle's bundled Mandiant intelligence

When Chronicle genuinely wins

+High-log-volume environments with little Microsoft 365 content (network, NetFlow, EDR, non-Azure cloud audit), where Chronicle's data-cap package undercuts Sentinel's per-GB rate on that volume
+Organisations whose log volume runs high relative to a licensed data-cap package, extracting strong value from the bundled cap
+Customers wanting bundled Mandiant threat intelligence (Enterprise) or Mandiant Hunt (Enterprise Plus) without a separate Mandiant Advantage subscription
+Google Cloud-native organisations where Chronicle's native integration and BigQuery-backed retention matter
+Enterprise consolidators valuing predictable annual data-cap pricing over per-GB optimisation discipline

FAQ

Common questions

Which is cheaper for a mid-market organisation, Sentinel or Chronicle?

It depends on log volume and Microsoft 365 share, not headcount. Chronicle meters a GB data cap (Google's filed list is $2.40 per GB per year on Enterprise, $1.95 on Standard), so its cost tracks volume just as Sentinel's does. At 50 GB per day Chronicle Enterprise lists at about $43.8K against Sentinel's $55K to $78K; with 30 percent Microsoft 365 free ingest Sentinel falls to roughly $55K, narrowing but not closing the gap. At 200 GB per day Chronicle Enterprise is about $175.2K and Sentinel about $200K on its 200 GB commitment tier. The decision turns on Microsoft 365 share (which lowers Sentinel) and whether the Mandiant bundle in Chronicle Enterprise is valued, not on employee count.

Does Chronicle price per employee or per GB?

Chronicle (Google SecOps) prices on a GB data cap sold in annual packages (Standard, Enterprise, Enterprise Plus) at a filed list of $1.95, $2.40 and $4.60 per GB per year respectively, not on a per-employee meter. Earlier Chronicle pricing was sometimes described as per-employee because Google sized the bundled data cap relative to a customer's seat count, but the billable meter is the data volume cap. The practical consequence is that Chronicle's cost rises with log volume much as Sentinel's does; the two do not diverge the way a genuine per-employee meter would. Google's data plane runs on internal infrastructure (Borg, BigQuery, Spanner) where storage and indexing are cheap at customer scale, which is why Chronicle can package generous data caps at competitive per-GB rates.

Does Microsoft 365 free ingest give Sentinel the edge?

Often, yes, in Microsoft-heavy estates. Sentinel ingests Office 365 audit logs (SharePoint, Exchange admin and Teams activity) and Microsoft Defender security alerts free for all customers, and Microsoft 365 E5, A5, F5 and G5 licences add up to 5 MB per user per day of free ingestion for further security logs (raw Entra ID sign-in and audit logs are otherwise billed at standard rates). For organisations where Microsoft sources are 50 to 70 percent of total ingest, Sentinel's billable volume drops sharply and it can undercut Chronicle's data-cap price even where raw volume looks similar. At 60 GB per day of which 40 GB is Microsoft 365, Sentinel effectively pays for 20 GB (around $31K at PAYG) against Chronicle Enterprise at about $52.6K list for 60 GB per day. Chronicle's advantage appears where non-Microsoft log volume dominates (network appliances, SaaS and non-Azure cloud audit, EDR telemetry), which Sentinel bills at full per-GB rate.

How does Chronicle's bundled Mandiant intelligence factor into the comparison?

Chronicle Enterprise tier bundles Mandiant threat intelligence feed integration; Enterprise Plus tier bundles Mandiant Hunt managed threat hunting service. Sentinel customers needing equivalent capabilities license Mandiant Advantage as a separate Microsoft offering or Google Mandiant Advantage directly, typically adding $50K-$200K per year depending on coverage scope. For organisations where Mandiant capability is the binding requirement, Chronicle Enterprise's bundle is structurally cheaper than Sentinel plus Mandiant Advantage at most scale points.

What about migration cost from Sentinel to Chronicle?

Sentinel-to-Chronicle migration is moderately complex because the detection content models differ. Sentinel uses KQL (Kusto Query Language) for detections; Chronicle uses YARA-L 2.0. Migration of 100-200 detections runs $100K-$200K in professional services plus 4-6 months calendar time. For organisations where the Chronicle licence saving is $150K-plus per year, payback under 18 months makes migration a clear positive ROI. For organisations where the saving is smaller, the migration is rarely the right call without a separate consolidation or strategic driver. The reverse migration (Chronicle to Sentinel) is similarly complex and rarely the right call without strategic driver.