Forum Discussion
Solved
Pricing Calculator for Microsoft Sentinel
Hi everyone, I am using the Pricing Calculator for Microsoft Sentinel. I can see the pricing split into two parts - Azure Monitor and Microsoft Sentinel. In my understanding, Microsoft Sentinel wil...
Hello CyrilChu,
The pricing is split into two parts - Azure Monitor and Microsoft Sentinel because:
Azure Monitor is considered to be the "Ingestion" part (GB of logs that are ingested into Log Analytics Workspace) and Microsoft Sentinel is the SIEM system itself that operates logs, queries, workbooks, connectors etc.
As far as I know, if you have 2 subscriptions and 2 Sentinels and use LightHouse to connect one Sentinel to another, you will still have to pay for both of them.
Because these are two separate Sentinels.
For example, you are a SOC company and have a customer who has Sentinel. And you want to connect your customer's Sentinel to your to see and manage data in your own system. The customer will have to pay for his Sentinel.
Because these are two separate Sentinels.
For example, you are a SOC company and have a customer who has Sentinel. And you want to connect your customer's Sentinel to your to see and manage data in your own system. The customer will have to pay for his Sentinel.
mikhailf,
I am not sure it have 2 Sentinels, the current situation is Customer Company use belows link to share his Resource group (Include Log Analytics Workspace and Already add Microsoft Sentinel to the workspace) to SOC Company.
https://github.com/Azure/Azure-Lighthouse-samples
As far as I know, we need to add Microsoft Sentinel to a workspace after you create a Log Analytics Workspace. SOC Company itself did not add Microsoft Sentinel to any workspaces before. SOC Company can connect to customer's Sentinel via lighthouse directly. We don't need to add Microsoft Sentinel to customer's workspace.
For this situation, it still count as two separate Sentinels?
I am not sure it have 2 Sentinels, the current situation is Customer Company use belows link to share his Resource group (Include Log Analytics Workspace and Already add Microsoft Sentinel to the workspace) to SOC Company.
https://github.com/Azure/Azure-Lighthouse-samples
As far as I know, we need to add Microsoft Sentinel to a workspace after you create a Log Analytics Workspace. SOC Company itself did not add Microsoft Sentinel to any workspaces before. SOC Company can connect to customer's Sentinel via lighthouse directly. We don't need to add Microsoft Sentinel to customer's workspace.
For this situation, it still count as two separate Sentinels?