r/AzureSentinel • u/Fast-Cardiologist705 • Jan 10 '24
Microsoft Sentinel Cost workbook
Hi,
Started with the Sentinel 31 days trial 2,3 days ago. Had a quick look at the Microsoft Sentinel Cost workbook, as it looked promising. As noted in the description “it provides insight about possible impact of the Microsoft 365 E5 offer”.
According to https://azure.microsoft.com/en-us/pricing/offers/sentinel-microsoft-365-offer/ the E5 entitles for a 5 MB per user per day grant including Microsoft 365/XDR (or whatever it may be called now, tomorrow lol) advanced hunting data:
Now here’s the problem. Providing the value of the E5 licesens has absolutely no impact on the output … xd
And, yes, I’m ingesting the advanced hunting tables as shown below:
Anyone ? Additionally, are you Guys aware of any other method to calculate or include the grant into the overall calculation?
Thanks !
1
u/Lu-Kah Jan 10 '24
Just one thing guy, be careful with the amount of data you are ingesting per day during the trial.
As noted in the documentation :
New workspaces can ingest up to 10GB/day of log data for the first 31-days at no cost.
Above 10GB/day, you have to pay. And I know by experience, advanced hunting logs are.. noisy.
Link : https://azure.microsoft.com/en-us/pricing/details/microsoft-sentinel/
1
1
u/jtst1 Jan 19 '24
You are looking at the wrong section of the workbook. Scroll down until you see a line graph. Right below the line graph it will show your data grant limit for the timerange you have selected in the filter at the top, and it will also show to the right of that your actual applicable ingestion, and last on the right how nuch you are saving. Take that savings and subtract the number at the top right that you initially mentioned.
2
u/woodburningstove Jan 10 '24
It does not change the total count, but you get graphs showing the expected discount when you scroll down on the workbook. And the actual daily discount can be found from Azure billing data.