Raw data connector pricing

%3CLINGO-SUB%20id%3D%22lingo-sub-1826461%22%20slang%3D%22en-US%22%3ERaw%20data%20connector%20pricing%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1826461%22%20slang%3D%22en-US%22%3E%3CP%3EHello!%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20have%20been%20trying%20to%20find%20out%20an%20approximate%20overview%20for%20pricing%20for%20different%20connectors%20in%20Sentinel(if%20they%20are%20free%2C%20discounted%2C%20if%20the%20use%20a%20lot%20of%20data%20or%20not).%3C%2FP%3E%3CP%3EMy%20organization%20has%20also%20requested%20i%20find%20out%20pricing%20for%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Fsentinel%2Fconnect-microsoft-365-defender%22%20target%3D%22_self%22%20rel%3D%22noopener%20noreferrer%22%3Ethis%20connector%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ESeeing%20as%20this%20is%20raw%20data%20i%20suspect%20it%20is%20going%20to%20generate%20a%20lot%20of%20data%20making%20it%20expensive%2C%20however%20this%20is%20data%20that%20has%20already%20been%20%22generated%22%20and%20as%20far%20as%20i%20have%20understood%20sentinel%20doesn't%20duplicate%20data%2C%20making%20this%20connector%20almost%20free(%3F)%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EAny%20clarification%20is%20much%20appreciated%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1826798%22%20slang%3D%22en-US%22%3ERe%3A%20Raw%20data%20connector%20pricing%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1826798%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F819982%22%20target%3D%22_blank%22%3E%40stianhoydal%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EThere%20are%20a%20few%20lists%20like%20this%20one%2C%20to%20see%20which%20primary%20tables%20are%20free%20or%20billable%20(after%20Ingestion%20you%20can%20confirm%20with%20my%20%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fazure-sentinel%2Fusage-reporting-for-azure-sentinel%2Fba-p%2F1267383%22%20target%3D%22_self%22%3EWorkbook%3C%2FA%3E%26nbsp%3Bor%20KQL%20%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Fazure-monitor%2Fplatform%2Fmanage-cost-storage)%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Fazure-monitor%2Fplatform%2Fmanage-cost-storage)%3C%2FA%3E.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%22If%20they%20use%20a%20lot%20of%20data%20or%20not%22%20-%20is%20a%20'it%20depends'%20answer%2C%20Azure%20Sentinel%20is%20based%20on%20%22%3CSPAN%3EAzure%20Sentinel%20is%20billed%20based%20on%20the%20%3CSTRONG%3Evolume%3C%2FSTRONG%3E%20of%20data%20ingested%20for%20analysis%20in%20Azure%20Sentinel%20and%20stored%20in%20the%20Azure%20Monitor%20Log%20Analytics%20workspace.%26nbsp%3B%22%3CBR%20%2F%3ESource%3A%26nbsp%3B%3C%2FSPAN%3E%3CA%20style%3D%22font-family%3A%20inherit%3B%22%20href%3D%22https%3A%2F%2Fazure.microsoft.com%2Fen-us%2Fpricing%2Fdetails%2Fazure-sentinel%2F%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3Ehttps%3A%2F%2Fazure.microsoft.com%2Fen-us%2Fpricing%2Fdetails%2Fazure-sentinel%2F%3C%2FA%3E%3CBR%20%2F%3E%3CBR%20%2F%3E%3CFONT%20face%3D%22inherit%22%3EYour%20usage%20%3C%2FFONT%3Epattern%3CFONT%20face%3D%22inherit%22%3E%26nbsp%3B%3C%2FFONT%3Emaybe%3CFONT%20face%3D%22inherit%22%3E%26nbsp%3Bvery%20different%20from%20others.%26nbsp%3B%20%26nbsp%3BI%20saw%20this%20%3C%2FFONT%3Erecently%3CFONT%20face%3D%22inherit%22%3E%26nbsp%3Bwith%20a%20company%20with%20a%20single%20%3C%2FFONT%3Efirewall%3CFONT%20face%3D%22inherit%22%3E%26nbsp%3Bthat%20was%20sending%20the%20same%20data%20volume%20as%20a%20customer%20with%26nbsp%3B~60%20of%20the%20same%20appliances.%26nbsp%3B%3C%2FFONT%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E
Contributor

Hello!

 

I have been trying to find out an approximate overview for pricing for different connectors in Sentinel(if they are free, discounted, if the use a lot of data or not).

My organization has also requested i find out pricing for this connector 

 

Seeing as this is raw data i suspect it is going to generate a lot of data making it expensive, however this is data that has already been "generated" and as far as i have understood sentinel doesn't duplicate data, making this connector almost free(?)

 

Any clarification is much appreciated

1 Reply

@stianhoydal 

 

There are a few lists like this one, to see which primary tables are free or billable (after Ingestion you can confirm with my Workbook or KQL https://docs.microsoft.com/en-us/azure/azure-monitor/platform/manage-cost-storage).

 

"If they use a lot of data or not" - is a 'it depends' answer, Azure Sentinel is based on "Azure Sentinel is billed based on the volume of data ingested for analysis in Azure Sentinel and stored in the Azure Monitor Log Analytics workspace. "
Source: 
https://azure.microsoft.com/en-us/pricing/details/azure-sentinel/

Your usage pattern maybe very different from others.   I saw this recently with a company with a single firewall that was sending the same data volume as a customer with ~60 of the same appliances.