Azure Sentinel with ASC and exsiting workspace

[avirat20]

Hello There,

Currently we have 2 workspaces created linked to ASC. One workspace for Production VMs and another for Non-Production VM.

We are planning to deploy Sentinel and have few questions

1) To avoid "multi-homing", should we consolidate both workspace as one and use single workspace for ASC , Azure monitoring and Sentinel?

2) for a best practice, Should we create a new workspace for Sentinel and use connectors to send events from ASC & Azure Monitor and etc?

We want to simply solution, avoid too many workspace and reduce cost.

3) Current workspace have data consumption of about 15-18 GB per day including all kind of logs. SO when we create cost for Sentinel, how do we estimate data?

Regards

Avi

[#2]

@avirat20 When you say "workspace" I am going to assume you mean a Log Analytics (LA) workspace.

1) It really depends if you are using (or plan to use) the Non-production information in Azure Sentinel.  Otherwise, you are just paying for data you are not using.  Azure Sentinel is always going to be a compromise of having all the data you will need versus paying for data you won't ever use.  "SolarGate" has changed the way a lot of people think about non-prod data so it may be that you will use the data now when in the past you probably wouldn't have. 

Also take into account where the data is located.  Are your prod and non-prod in the same Azure region?  If not, there is egress charges that need to be considered.   You can also take a look at using Azure Lighthouse with Azure Sentinel to view different Azure Sentinel instances at one time.

2) I typically say to let the Azure Security products do what they are good at and then  just send the alerts from ASC to Azure Monitor.   One analogy I like is that Azure Sentinel is a backstop to catch everything that the other Azure security products miss (although this may not make sense to to non-Americans.  Think of it as the netting in the football goal so the ball stops if all the other plays and goalie misses it) However, if you need the data for an investigation, you won't have it (hopefully this will change in the future).

3) Use the Azure pricing calculator, add Azure Sentinel to it, select your region, and plug in your consumption rate to get the most accurate pricing estimate.

[#3]

@avirat20 

To the specific question about ASC and Azure Sentinl: you should use the same workspace. ASC itself does not use the workspace, and the value stems from Sentinel features.

What you may want to do, is split none security data to a seperate workspace for cost reasons. This would imply dual homing.