Forum Discussion

Maxou's avatar
Maxou
Copper Contributor
Feb 15, 2021

Technical details and integration

Hi All,

I was wondering if you can help with the following questions please?

 

- What datastore does Sentinel use?
- Does Sentinel allow to backup the data in Azure blob store and search it ?
- Is it easy to get data out of Sentinel what is the cost?

- How do we can collect logs and audit logs from PASS services like API management services , Azure cosmos , Synapse workspace and PowerBI Embedded?
- Also how is the cost calculated if you increase the retention from 31 days to 90 days ?
Thanks I really appreciate your help.

 

Maxou

4 Replies

  • GaryBushey's avatar
    GaryBushey
    Bronze Contributor

    Maxou Some of these answers are the same as what @printscreen listed and some are new.

     

    - What datastore does Sentinel use?

    It uses Log Analytics Workspaces to store all the data, hence why there is a Azure Sentinel ingestion fee and a Log Analytics ingestion fee as part of the price.
    - Does Sentinel allow to backup the data in Azure blob store and search it ?

    Yes. but it isn't easy.  You would need to use the "externdata" command and know exactly where the data is located.  There was a blog post recently about pushing old data into Azure Data Explorer which, while it costs more than Blob storage, allows you to easily query it
    - Is it easy to get data out of Sentinel what is the cost?

    Define easy 😉   You can extract data without too much hassle and the charge would be the data egress charge if the data leaves the region.

    - How do we can collect logs and audit logs from PASS services like API management services , Azure cosmos , Synapse workspace and PowerBI Embedded?

    Most Azure services, although not all, allow you to setup monitoring which you can send to the Log Analytics workspace.  I am unsure if all of those can do it.  Plus there are more and more data connectors coming out all the time so it is possible that there will be a direct connector for those in the future.
    - Also how is the cost calculated if you increase the retention from 31 days to 90 days ?

    Azure Sentinel gives you 90 days of data retention for free so there is no additional cost going from 31 to 90 days.   After 90 days there is a per gigabyte per month charge which varies depending on the region.  I suggest using the Azure price calculator web site (Pricing Calculator | Microsoft Azure) to determine your costs.

  • printscreen's avatar
    printscreen
    Brass Contributor

    Maxou I could be able to answer few questions - 

     

    - What datastore does Sentinel use? [Sentinel stores all logs which got ingested, in log analytics]
    - Does Sentinel allow to backup the data in Azure blob store and search it ? 
    - Is it easy to get data out of Sentinel what is the cost? [you can remove sentinel easily, pls go thru this https://docs.microsoft.com/en-us/azure/sentinel/offboard?WT.mc_id=Portal-Microsoft_Azure_Security_Insights]

    - How do we can collect logs and audit logs from PASS services like API management services , Azure cosmos , Synapse workspace and PowerBI Embedded? [you can easily collect any azure resource logs(in fact, a few non-Microsoft vendor logs too) through diagnostic settings. For example, if we consider APi managements service, go to Azure portal ->APIM-> Diagnostic settings-> click on '+ Add diagnostic settings'. Select appropriate logs and map the sentinel log analytic workspace there and save it)
    - Also how is the cost calculated if you increase the retention from 31 days to 90 days ? [With best of my knowledge, For Azure Sentinel enabled workspaces the data is retained for free for 90 days, Retention beyond 90 days will be charged per the standard https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fazure.microsoft.com%2Fen-us%2Fpricing%2Fdetails%2Flog-analytics%2F&data=04%7C01%7Cnikitha.cheemati%40kontex.com%7C23d170a576bb4fab535108d8951409bd%7C6bfdb47acb3e4b91854a9d201e501f6a%7C0%7C0%7C637423260585495280%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=Q%2FLqt1xpwedKpVN86sRb0WKrsXnsVwywQLNuAIhVOwg%3D&reserved=0 retention prices (as outlined https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fazure.microsoft.com%2Fen-us%2Fpricing%2Fdetails%2Fazure-sentinel%2F&data=04%7C01%7Cnikitha.cheemati%40kontex.com%7C23d170a576bb4fab535108d8951409bd%7C6bfdb47acb3e4b91854a9d201e501f6a%7C0%7C0%7C637423260585505235%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=dE1nVAQXu2Uy11pL5A4iyP4rHsqqG7OGIZOaowaouY4%3D&reserved=0). Only if you do configure some changes in sentinel settings, you will find an option to increase data ingestion]

     

    I hop it helps.