Federal Migration Guide: Splunk to Sentinel in Government¶

Status: Authored 2026-04-30 Audience: Federal CISOs, DoD Security Architects, Civilian Agency Security Teams, AOs Purpose: Federal-specific guidance for migrating from Splunk to Microsoft Sentinel in Azure Government environments

1. Federal SIEM landscape¶

Splunk's federal dominance¶

Splunk holds the dominant SIEM market position across the US federal government:

What this means for migration planning: The federal Splunk ecosystem is large, mature, and deeply embedded. Migration is not just a technology change -- it requires addressing procurement vehicles, existing BPAs, trained workforce, and institutional knowledge.

Sentinel's federal growth¶

Microsoft Sentinel in Azure Government is growing rapidly:

• Multiple DoD components have completed or are executing Splunk-to-Sentinel migrations
• ArcSight end-of-life is driving federal agencies to Sentinel as a replacement
• The SIEM Migration Experience was designed specifically for large federal Splunk deployments
• Azure Government FedRAMP High authorization provides compliance foundation
• Sentinel is increasingly specified in new federal RFPs alongside or instead of Splunk

ArcSight displacement in DoD¶

Micro Focus ArcSight, once the dominant DoD SIEM, is reaching end-of-life. Sentinel is the primary beneficiary:

2. Azure Government for Sentinel¶

Authorization and compliance¶

Azure Government vs Azure Commercial for Sentinel¶

Azure Government endpoints¶

3. Federal compliance and event retention¶

Event retention requirements by framework¶

Implementing federal retention in Sentinel¶

// Bicep: Configure federal-compliant retention
resource workspace 'Microsoft.OperationalInsights/workspaces@2022-10-01' = {
  name: 'law-sentinel-gov'
  location: 'usgovvirginia'
  properties: {
    sku: {
      name: 'PerGB2018'
    }
    retentionInDays: 365  // 1-year online retention (FedRAMP High minimum)
    features: {
      enableDataExport: true  // Enable export to ADX for long-term
    }
  }
}

// Per-table retention for compliance
resource securityEventRetention 'Microsoft.OperationalInsights/workspaces/tables@2022-10-01' = {
  parent: workspace
  name: 'SecurityEvent'
  properties: {
    retentionInDays: 365      // 1 year interactive
    totalRetentionInDays: 2555 // 7 years total (archive)
  }
}

// Data export to ADX for long-term hunting
resource dataExportRule 'Microsoft.OperationalInsights/workspaces/dataExports@2020-08-01' = {
  parent: workspace
  name: 'export-to-adx'
  properties: {
    destination: {
      resourceId: adxCluster.id
      metaData: {
        eventHubName: 'sentinel-export'
      }
    }
    tableNames: [
      'SecurityEvent'
      'CommonSecurityLog'
      'SigninLogs'
      'AuditLogs'
    ]
    enable: true
  }
}

4. CISA CDM integration¶

CDM dashboard migration¶

Many federal agencies use Splunk for CDM (Continuous Diagnostics and Mitigation) dashboard integration. Sentinel supports CDM through:

CDM data flow to Sentinel¶

flowchart LR
    CDM_SENSORS[CDM Sensors] --> CDM_FEED[CDM Data Feed]
    CDM_FEED --> SENTINEL[Microsoft Sentinel]
    SENTINEL --> WORKBOOK[CDM Workbooks]
    SENTINEL --> PBI[Power BI - CSA-in-a-Box]
    SENTINEL --> CISA[CISA CDM Dashboard feed]

5. DoD-specific considerations¶

DoD SIEM requirements¶

IL4/IL5 deployment architecture¶

flowchart TD
    subgraph IL4["Azure Government - IL4"]
        S4[Sentinel Workspace - IL4]
        AMA4[AMA on IL4 endpoints]
        PB4[Playbooks - Logic Apps]
    end

    subgraph IL5["Azure Government - IL5"]
        S5[Sentinel Workspace - IL5]
        AMA5[AMA on IL5 endpoints]
        PB5[Playbooks - Logic Apps]
    end

    subgraph CSA["CSA-in-a-Box Analytics"]
        FAB[Fabric - cross-classification analytics]
        PBI[Power BI - CIO/CISO dashboards]
        ADX[ADX - long-term retention]
    end

    AMA4 --> S4
    AMA5 --> S5
    S4 --> FAB
    S5 --> FAB
    S4 --> ADX
    S5 --> ADX
    FAB --> PBI

IL5 data must remain in Azure Government regions that support IL5 workloads. Ensure Log Analytics workspace, ADX cluster, and all data export destinations are in IL5-authorized regions.

6. ATO considerations¶

Sentinel in the agency SSP¶

When migrating from Splunk to Sentinel, the agency's System Security Plan (SSP) must be updated:

CSA-in-a-Box compliance support¶

CSA-in-a-Box provides machine-readable compliance matrices that map to Sentinel controls:

7. Federal procurement considerations¶

Contract vehicles for Sentinel¶

Cost comparison for federal¶

Splunk federal contracts typically include:

• Multi-year term licenses with fixed GB/day commitment
• Splunk ES premium (50-100% on top of base)
• Splunk SOAR as separate line item
• Professional services / contractor support

Sentinel federal costs are:

• Consumption-based (no term commitment required, but commitment tiers offer discounts)
• No separate ES/SOAR licensing
• Free Microsoft data sources (significant for M365/Entra/Defender shops)
• CSA-in-a-Box infrastructure costs for analytics extension

8. Federal migration timeline¶

Federal SIEM migrations require additional time for compliance documentation, ATO updates, and change management:

9. IL6 split architecture¶

For agencies with both unclassified and classified SIEM requirements:

Recommendation: Migrate IL2-IL5 workloads to Sentinel. Maintain Splunk (or evaluate alternatives) for IL6. Use CSA-in-a-Box as the analytics layer for unclassified security data, combining Sentinel telemetry with other agency data in Fabric lakehouses.

10. Federal-specific CSA-in-a-Box integration¶

CSA-in-a-Box provides federal-specific value for security data:

Next steps:

• Migration Playbook -- full migration plan
• TCO Analysis -- federal cost comparison
• Best Practices -- federal migration strategy
• Benchmarks -- performance data

Maintainers: csa-inabox core team Last updated: 2026-04-30