MicrosoftThanks for those post Sven-Matzen and Rogier Dijkman both have cleared things up.
I guess the main thing is that if you work for a large company and have a 24x7 SOC you will take the hit on the 2880 US$ bill per month because are you really going to be wanting to have to spin up C4S for every investigation, no you want it there immediately.
For MSSP's working with several smaller companies that are maybe spending only 200-500 dollars a month on Sentinel costs adding C4S on top of that will then potentially be too costly for them so they won't want to adopt it. Then as the MSSP you don't want to be in the position of having to make sure you turn it on and off all the time. On top of that does how it works lend itself to being turned on and off or does it need to be on all the time to "learn" and be reactive?
