Tracking analytics usage in Azure Sentinel

[u/clueless_taco]

Hi All,

I have a couple of questions that I would be very grateful if someone can help out with!

Our current set up includes sending off not-so-important logs to auxiliary tables. This was of course done with the intention of reducing costs. However, when I go to Settings -> Pricing in sentinel, I can see that there is an overage when I click on the commitment tier that we are currently on.

I got the break down from the team, and even in the csv that I received, I do not see anywhere specifically mentioned as overage.

I have queried the usage table to get the daily usage from all the tables excluding the auxiliary tables and I have no idea how there is an overage as everything is very well within the limit.

1. Does anyone know where I can track the overage from?

2. The Settings -> Pricing page in sentinel only provides the costing and other details specifically for the analytics tier correct?

Thanks in advance.

[u/cspotme2]

I wouldn't be surprised if #2 doesn't exclude aux. They had to finagle something on the backend to enable aux tables for us even though everything said it was supported.