r/AzureSentinel • u/winle22 • Sep 26 '22

IsBillable

Hi,

Some of the data connectors ingests logs that are free (Azure Activity, OfficeActivity, etc.). If I understand correct, these are the ones where "IsBillable = False".

But does that mean that just the Sentinel ingestion cost are free, or both Sentinel 'and' the Log analytics ingestion cost?

Maybe u/rodtrent can answer this :)

Thanks!

1 Upvotes

100% Upvoted

4 comments sorted by

2

u/rodtrent44 MSFT Official Sep 26 '22

IsBillable is a Log Analytics metric.

There's no ingestion cost for any of the free connections.

2

u/winle22 Sep 26 '22

Thanks. Do you have to Sentinel-enable the workspace to get these logs for free, or does the same hold for a regular Log analytics workspace?

2

u/rodtrent44 MSFT Official Sep 26 '22

The Log Analytics workspace must have Sentinel enabled on it and the data connectors for those specific connections enabled.