log-horizon

Log Horizon is a Microsoft Sentinel SIEM log source analyzer designed to evaluate the security value of log tables being ingested in a Sentinel workspace. Its primary use case is to classify logs, score their relevance against detection rules, and provide actionable recommendations to optimize log management and reduce costs while enhancing security posture. Notable features include a comprehensive classification engine, cost-value scoring matrix, detection mapping, and automated recommendations for improving log ingestion practices.