Skip to content

SenseOn Scoping Questions

SenseOn uses these questions to understand the size and shape of your environment. Your answers let us price the deployment accurately, identify the integrations and log sources involved, and design an onboarding plan that fits your security, compliance and operational goals.

How to use this page

  • Answer what you can. Estimates are fine, and "not sure" is a useful answer because it tells us where to help.
  • The numbered sections cover your whole estate and are what we use for pricing.
  • If you want SenseOn to ingest logs, also complete the log source detail template once for each source.
  • Your SenseOn contact can work through any section with you, including estimating log volumes.

ℹ Tip: If the answer differs between parts of your organisation (for example, by region, business unit or AWS account), give a short breakdown rather than a single total.

1. Goals and requirements

  1. What are the main outcomes you want from SenseOn? (For example, threat detection and response, a managed SOC, visibility of AI use, consolidating security tools, or meeting audit requirements.)
  2. Which regulations, standards or contractual obligations apply to you? (For example, ISO 27001, SOC 2, Cyber Essentials Plus, GDPR, PCI DSS, NIS2 or DORA.)
  3. Which systems or parts of your environment are blind spots for your current tools?
  4. Which attacks or risks concern you most?
  5. Have you had problems collecting or managing security data in the past? (For example, gaps in coverage, data parsed incorrectly or costs rising faster than expected.)
  6. Where must your data be stored and processed? Do any customer contracts require a particular country or region?
  7. What is your timeline for a decision and for deployment? Are there change freezes we should plan around?
  8. For the systems SenseOn will integrate with or deploy to (cloud tenants, identity providers, firewalls, proxies, endpoints and log sources), who can make the configuration changes we will need, and what is your change control process? Include typical lead times and any approvals we should plan around.

2. End user devices (Universal Sensor)

End user devices are laptops, desktops and virtual desktops.

  1. How many end user devices are there?
  2. Which operating systems and versions are in use, and how many devices run each one?
  3. Which countries or regions are the devices in?
  4. Which deployment tools do you use? (For example, Intune, SCCM, Group Policy, Jamf Pro or Kandji.)
  5. Do you use virtual desktops (VDI)?
    • Which VDI technology do you use, and is it for applications or full desktops?
    • How many virtual desktops are online on an average day?
    • Are they included in the device count above?
  6. Which endpoint security products are installed today?

3. Servers (Universal Sensor)

Include on-premises servers and cloud instances, such as AWS EC2 or Azure virtual machines.

  1. How many servers are there, and where are they hosted? (On premises, colocation, AWS, Azure, GCP or another provider.)
  2. Which operating systems are in use, and how many servers run each one?
  3. For Linux servers, which distributions and kernel versions are in use? Do any run on ARM processors, such as AWS Graviton?
  4. Which deployment tools do you use for servers? (For example, AWS Systems Manager, Ansible, Terraform, SCCM or a golden image pipeline.)

💡 Check your Linux servers against the supported distributions, kernel versions and processor architectures in Endpoint Requirements.

4. Network and device configuration

  1. Do any devices use proxy servers? How are they configured (for example, a PAC file)?
    • Can applications bypass the proxy if necessary?
    • Who manages the proxy configuration?
  2. Is TLS interception used for any devices or parts of the network?
    • Who manages TLS interception?
  3. Is outbound internet access restricted by firewall rules or allow lists? Who manages those changes?
  4. Do you use a secure web gateway, SASE or ZTNA service? (For example, Netskope, Zscaler, Cloudflare or Cisco Umbrella.)

5. Identity and productivity platforms

  1. Do you use Microsoft 365?
    • How many users are licensed, and at which subscription level? (For example, E3 or E5.)
  2. Do you use Google Workspace?
    • How many users are licensed, and at which subscription level? (For example, Business Plus or Enterprise Standard.)
  3. Which identity platforms do you use? (For example, Entra ID, on-premises Active Directory, hybrid Entra ID and Active Directory, Okta or Ping Identity.)

6. Security tooling

  1. Which antivirus or EDR product do you use today?
  2. Are you considering SenseOn Endpoint Protection, or do you want SenseOn to integrate with your existing product?
  3. Do you use a SIEM or log management platform today? Which one, and when does the contract end?
  4. Which email security products do you use? (For example, Microsoft Defender for Office 365, Mimecast or Abnormal.)
  5. Which other security tools would you like SenseOn to integrate with? (For example, vulnerability management, cloud security posture or ticketing tools.) See Data Connectors for the current list.
  6. Does another provider already manage any of your security tools or monitoring? (For example, a managed EDR service.) How should SenseOn cases and their tickets work alongside them?

7. AI tools

  1. Which AI assistants and AI coding tools are approved for use? (For example, Microsoft Copilot, ChatGPT, Claude, Amazon Q Developer or Kiro.)
  2. Which plans or licences do you have for them, and who holds the administrator role?
  3. Do you route AI traffic through an AI gateway or proxy? (For example, Cloudflare AI Gateway.)
  4. Do you use or build MCP servers or AI agents? Where do they run?
  5. Do you have a written AI usage policy or guardrails document? SenseOn can turn its rules into detections.

💡 Some AI tools can send usage telemetry straight to SenseOn. See Claude Code Telemetry for an example.

8. Cloud environments

All providers

  1. Do you use containers? How many clusters and nodes, and on which processor architecture?
    • How are the nodes managed? (For example, EKS with EC2, EKS with Fargate, AKS, GKE or self-managed Kubernetes.)
  2. Do you use serverless technologies? Please give details and rough scale.
  3. Which teams own your cloud accounts, subscriptions or projects? Who can make the configuration changes SenseOn needs (for example creating an app registration or granting admin consent), and who approves them?
  4. Are there any other cloud or SaaS platforms we should know about?

Provider details

Answer the tabs that apply to you.

  1. How many AWS accounts do you have, split between production and non-production? Do you use AWS Organizations or Control Tower?
  2. Which regions are in use, and where do your main workloads run?
  3. Broadly, which services are in use and at what scale? (For example, the number of EC2 instances, EKS or ECS clusters and nodes, Lambda functions, databases, and internet-facing load balancers, API Gateways or CloudFront distributions.)
  4. Which AI services run in AWS, and in which accounts? (For example, Amazon Bedrock, Amazon Q, Kiro or SageMaker.)
  5. Which AWS security services are enabled? (For example, GuardDuty, Security Hub, Inspector, Config, Macie, WAF or Firewall Manager.) Is there a delegated administrator account?
  6. How is CloudTrail set up?
    • Is there an organisation trail, or a trail in each account?
    • Where are the logs delivered? (For example, S3 in a central log archive account, or CloudWatch Logs.)
    • Does it capture management events only, or data events (such as S3 and Lambda) as well?
  7. Are VPC flow logs enabled? What do they cost each month?
  8. Roughly how much do you spend on CloudWatch Logs each month?
  1. How many subscriptions do you have, split between production and non-production? Do you use management groups?
  2. Which regions are in use, and where do your main workloads run?
  3. Broadly, which services are in use and at what scale? (For example, virtual machines, AKS clusters and nodes, Functions, databases and public endpoints.)
  4. Do you use Defender for Cloud? Which plans are enabled?
  5. Do you export Activity Logs or diagnostic logs to Event Hubs, a storage account or a Log Analytics workspace?
  1. How many projects do you have, split between production and non-production? Do you use an organisation and folders?
  2. Which regions are in use, and where do your main workloads run?
  3. Broadly, which services are in use and at what scale? (For example, Compute Engine instances, GKE clusters and nodes, Cloud Run, Cloud Functions and databases.)
  4. Do you use Security Command Center? Which tier?
  5. Are Cloud Audit Logs routed to a central sink? Which log types are enabled?

9. Log ingestion

Complete this section if you want SenseOn to ingest logs that the Universal Sensor and Data Connectors do not already cover. Log Ingestion Overview explains how to choose which logs to send.

  1. Which log sources do you want SenseOn to ingest? List your top sources first.
  2. What is the expected daily volume for each source, in GB? If you don't know, an estimate of daily events helps.
  3. For each source, which log pipeline do you need?
    • Detection & Response: analytics and alerting.
    • Observability: searchable for investigation and threat hunting.
    • Compliance: archived for audit only, at lower cost.
  4. For sources that need analytics, which detections matter most?
  5. How long must each source be kept, both searchable and archived? See Data Retention.
  6. Can any data be filtered out before it is sent? (For example, noisy services, health checks or read-only API calls.)
  7. How would you prefer to send logs? See the Receive, Relay and Retrieve deployment models.
  8. Do logs pass through other tools before they would reach SenseOn? (For example, Logstash, Fluentd or Cribl.) What do those tools change?

💡 Estimating volume. Your current SIEM or log platform usually reports daily ingest for each source. In AWS, the IncomingBytes metric for a CloudWatch Logs log group, or a week's growth of the S3 bucket that receives the logs, gives a good estimate.

Log source detail

Copy this table and complete it for each log source you want to add. We go through each one with you to design the collection.

Field Your answer
Log name (for example, DNS logs or firewall logs)
System or product, with version (for example, Cisco ASA 5525 or Kubernetes 1.28)
Location and infrastructure (for example, on-premises server, AWS EKS or SaaS)
Collection method (for example, syslog to an on-premises forwarder, an S3 bucket or an API)
Log format (for example, JSON, CEF, syslog or key-value pairs)
Daily volume (GB per day, or events per day if unknown)
Pipeline (Detection & Response, Observability or Compliance)
Retention (searchable months and archived months)
Filtering or intermediate tools
Why you need it (the risk it covers or the requirement it meets)

10. Network probes

SenseOn network probes can be deployed where there are significant numbers of legacy or Operational Technology (OT) systems that cannot run the Universal Sensor.

  1. Do you need standalone network probes?
    • How many probes are likely to be needed?
    • Which environments will the probes monitor?
    • What is the likely average sustained bandwidth (not link speed) of the traffic at each probe?

11. Managed services

  1. Would you like to run the platform yourself, have SenseOn manage it, or take a hybrid approach?
  2. Who should the SOC contact during and outside working hours? Which time zones are your teams in?
  3. What may the SOC do without asking first? (For example, isolate a device or disable a user account.)
  4. Do you have any other managed service requirements?

12. Commercial

  1. How do you expect your estate to grow over the next three years? (For example, devices, servers, cloud accounts or log volume.)
  2. Do you have a preferred partner who handles your security purchases?
  3. Would you like to buy through a cloud marketplace, such as AWS Marketplace, against an existing cloud spend commitment?