Forum Discussion

Brass Contributor

Aug 09, 2021

Determine events per second for a potential Sentinel deployment

I have been tasked to determine the estimate of EPS (events per second) for 4 subscriptions. Need to get an idea of the cost of creating an Event Hub to send data to the SIEM. Any assistance/guidan...

CliveWatson

Former Employee

Aug 10, 2021

SergioT1228

If you have the data in a workspace already, you can query that for EPS, you may need to add a filter, something like this (not all tables store SubscriptionId though!)

| where SubscriptionId == "< sub id>"

union withsource=_TableName1 *
| where _TimeReceived  > ago(1d)
| summarize count()  by bin(_TimeReceived, 1m), Type
| extend counttemp =count_ / 60
| summarize 
           ['Average Events per Second (eps)'] = avg(counttemp), ['Minimum eps']=min (counttemp),
           ['Maximum eps']=max(counttemp)

snteran

Copper Contributor

Aug 10, 2021

Hello Clive, Thank you for your reply. I'm new to gathering data from Azure. I mainly deal with ATP deployments and making sure to get all endpoints covered by Defender. I have been asked to help determine the EPS for some subscriptions. I have a couple of questions regarding your statement. I understand the need to specify which subscription.

Under Monitor > Logs, I have selected the scope to be a specific subscription. As far as withsource = _TableName1, which table are you referring? I AzureMetrics? Diagnostics? Activity?

Sorry if this should be obvious but I'm just getting started on learning how to obtain logs/data from Azure. I did do a count for the Three tables I saw, are those counts worth anything?

AzureActivity | where SubscriptionId == "subscriptionId" | count