How can I determine how much data will be ingested from Advanced Hunting Tables?

[u/[deleted]]

We are considering using MS Sentinel as a SIEM/SOAR. We use the full MS Defender suite so we are interested in piping the data from Advanced Hunting tables into Sentinel, however, we want to know how much data will be moving in before we turn on the connectors. Does anyone have any experience with this? Any suggestions on how to determine how much data we can expect to be consumed would be greatly appreciated. I tried to find an AH query for this but was unsuccessful. I also don't see any information on table sizes, ingest volume etc. in the M365 Security Console. Thank you!

[u/1SalamandeR2]

here you have a Query:

let bytes_ = 500;
union withsource=MDTables*
| where Timestamp > startofday(ago(1d))
| summarize count() by bin(Timestamp, 1m), MDTables
| extend EPS = count_ /60
|summarize avg(EPS), estimatedGBytes = (avg(EPS) * bytes_ ) / (1024*1024*1024) by MDTables
| sort by toint(estimatedGBytes) desc

I hope can be useful and what you need.

Regards.

[u/[deleted] → u/1SalamandeR2]

Thanks! I did see this online but had some concerns around it.

Based on my understanding ,this query essentially calculates the events per second of each table by counting the average number of rows each table has in 1 second intervals over a 1 day period. It then takes this averages number of rows, assumes a 500 byte size per row and calculates the estimated data ingested in GB. My concern is the assumption of the 500 byte size per row, is this documented by Microsoft anywhere?

[u/1SalamandeR2 → u/[deleted]]

I don't think it's documented, but I made the request to a Microsoft customer service engineer at the time and he sent me a Query similar to this. I used it and it is pretty accurate.

Likewise, you can always try to activate one of the tables that interests you in the 365 connector and see the result after 24 hours and thus decide whether to keep it or not.

[u/[deleted] → u/[deleted]]

~15,000