Forum Discussion
Sentinel log ingestion
@macd in Microsoft Sentinel Hello, I have one question regarding log ingestion. If we already have logs in the log analytic workspace and later if we enable sentinel in the same workspace, the...
Logs are only ingested once, Sentinel reads them, so they will be available to you *after* you enable Sentinel
- Clive_Watson.
Hello, Thank you for the confirmation,. Will there be extra cost if sentinel reads the logs.Microsoft Sentinel has a similar billing, model to Log Analytics, please look up "Sentinel" in Pricing Calculator | Microsoft Azure
The total monthly price is for the Ingestion + Sentinel to analyse those same logs
"Microsoft Sentinel is billed for the volume of data stored in an Azure Monitor Log Analytics workspace and analyzed in Microsoft Sentinel."- Thank you Clive_Watson,
That means if we need to pull logs from one sentinel workspace to other sentinel workspace then we will be paying charge of analysis by sentinel two times one in the sentinel where there is log and one in sentinel where we are pulled that log.
