5.5 Cost Management and Optimization

Cost Management and Optimization

By the end of this subsection, you will understand commitment tier pricing, be able to estimate ingestion costs, know which data sources are free, and have KQL queries for monitoring your own costs.

Sentinel cost management is a core operational skill. An unmonitored workspace can generate surprise bills that threaten the entire deployment. This subsection teaches you to predict, control, and monitor costs from day one.

Pricing model

Sentinel has two cost components:

1. Log Analytics ingestion — the cost of storing data in the workspace. This is the dominant cost. Priced per GB/day.

2. Sentinel analytics — the cost of running Sentinel features (rules, incidents, automation) on top of the workspace. Priced per GB/day of data analyzed.

Both components offer commitment tiers with volume discounts:

Free data sources

Several Microsoft data sources are included in Sentinel at no additional ingestion cost:

• Azure Activity logs — Azure management plane events
• Office 365 Audit logs (basic) — Exchange, SharePoint, Teams events via the Office 365 connector
• Alerts from Microsoft products — SecurityAlert table data from Defender products
• Microsoft Defender XDR incidents — SecurityIncident table data
• Entra ID Identity Protection — risk events (with Entra ID P2)

Estimating daily ingestion

Before deploying, estimate what your workspace will cost. Use these rules of thumb:

KQL for cost monitoring

Run these queries weekly to track your ingestion and catch anomalies:

Daily ingestion trend:

1
2
3
4
5
6

Usage
| where TimeGenerated > ago(30d)
| where IsBillable == true
| summarize DailyGB = round(sum(Quantity) / 1024, 2)
    by bin(TimeGenerated, 1d)
| sort by TimeGenerated asc

Ingestion by data type — finding the source of spikes:

1
2
3
4
5
6
7

Usage
| where TimeGenerated > ago(7d)
| where IsBillable == true
| summarize DailyGB = round(sum(Quantity) / 1024, 2)
    by DataType, bin(TimeGenerated, 1d)
| where DailyGB > 1
| sort by TimeGenerated desc, DailyGB desc

Data Collection Rules (DCRs) for filtering

DCRs are transformation pipelines that process data before it reaches your workspace. They can filter rows, drop columns, and transform data — reducing both ingestion cost and storage.

Example: Your Palo Alto firewall sends every connection event. A DCR can filter to only ingest denied connections, IDS/IPS alerts, and URL filtering events — dropping the permitted traffic that accounts for 80% of the volume.

DCRs are configured per data source. Detailed DCR construction is covered in Module 6 (Data Connectors & Ingestion Strategy).