Rows are signal families, columns are the stages every signal passes through. The matrix makes gaps visible where a flow diagram hides them.
Every row must reach the Act column. A signal collected and stored but never acted on is cost without control, and three of these rows were exactly that before this design.
Detection is defined alongside the signal, not after an incident. Each of the 27 Sentinel rules names its response and its owner.
What gets someone woken up
Break-glass sign-in and role assignment made outside the IaC pipeline are P1, paging the IAM on-call immediately.
PIM activation without a ticket reference and a service principal signing in from a new ASN are P2, reviewed within the working day.
Dormant entitlement and permission-creep findings are backlog items with an owner, not alerts. Paging on posture drift trains people to ignore pages.
Cost and gaps
240 GB per day, of which sign-in logs are roughly 70%. Non-interactive sign-ins go to the basic tier and archive; only summaries reach the analytics tier.
Per-application SCIM provisioning health has no dedicated alert today. It is an open item, and the visible gap is why it is on this page.
Sentinel commitment tier is sized on analytics-tier ingest only, so it must be re-checked whenever the log split changes.
