@Maxou Some of these answers are the same as what @printscreen listed and some are new.
- What datastore does Sentinel use?
It uses Log Analytics Workspaces to store all the data, hence why there is a Azure Sentinel ingestion fee and a Log Analytics ingestion fee as part of the price.
- Does Sentinel allow to backup the data in Azure blob store and search it ?
Yes. but it isn't easy. You would need to use the "externdata" command and know exactly where the data is located. There was a blog post recently about pushing old data into Azure Data Explorer which, while it costs more than Blob storage, allows you to easily query it
- Is it easy to get data out of Sentinel what is the cost?
Define easy ;) You can extract data without too much hassle and the charge would be the data egress charge if the data leaves the region.
- How do we can collect logs and audit logs from PASS services like API management services , Azure cosmos , Synapse workspace and PowerBI Embedded?
Most Azure services, although not all, allow you to setup monitoring which you can send to the Log Analytics workspace. I am unsure if all of those can do it. Plus there are more and more data connectors coming out all the time so it is possible that there will be a direct connector for those in the future.
- Also how is the cost calculated if you increase the retention from 31 days to 90 days ?
Azure Sentinel gives you 90 days of data retention for free so there is no additional cost going from 31 to 90 days. After 90 days there is a per gigabyte per month charge which varies depending on the region. I suggest using the Azure price calculator web site (Pricing Calculator | Microsoft Azure) to determine your costs.
