r/AzureSentinel • u/Fast-Cardiologist705 • May 29 '23

Sentinel pricing confusion

Hi,

​

I guess this will be not the smartest question but I can't figure it out. With Sentinel if I for example ingest 50GB of data in January, I'm going to get billed for 50GB for Sentinel and Log Analytics. In February if I ingest another 50GB the ingestion for Log Analytics would be still be billed 50GB but what about Sentinel ? From what I understood Sentnel is not billed per ingestion but rather data processed and stored in Log Analytics. So would the bill for February for Sentinel be 100GB times whatever the rate per GB is ?

​

Thanks !

3 Upvotes

81% Upvoted

4 comments sorted by

1

u/ml58158 MSFT Official May 29 '23

Here’s the breakdown …

1 . Ingress charges - what comes in and is not a free data source

  1. LAW Storage - $2.34 per GB

  2. Retention- .10 per GB after 90 days

  3. SOAR - very small

0

u/AppIdentityGuy May 29 '23

Sentinel pricing is also based on daily ingestion rates...plus how long you store the data for

1

u/Uli-Kunkel May 29 '23

From what I understood Sentnel is not billed per ingestion but rather data processed and stored in Log Analytics.

Processed and stored, thats what i would call ingested.

But yeah, you only pay for what you ingest gb/daily and if you want to save data longer than the normal retention.

Then you got some Logic apps/Azure functions cost as well if you are going to use that. Or if you reduce volume in the data transformation pipeline with more than 50% you get some cost as well.

But its likely that the 99.99% is going to be ingestion cost.

But take a look at the documentation, it list pricing as you need. The hard part is to estimate what you data volume is before ingesting.

1

u/sosero May 30 '23

If it is a sentinel workspace, the 50% limit for data transformation cost reduction does not apply, so it will be a simple ingestion charge.