Sentinel Cost Estimation

Question

Good evening community,&nbsp;I need some help understanding the costing for Sentinel. I'm trying to build a case for Sentinel as a compete to an existing solution.&nbsp;The environment has around 1000 server, 400 endpoints, and 50 network devices.They have a big investment in Microsoft security services (ATA, ATP, Defender, MDM, etc.) with O365 E5.&nbsp;But I digress...&nbsp;Am I correct that they will not be charged for any log ingestion from ATP, ASC, O365, and MCAS into Sentinel when connecting to these sources?&nbsp;What will they be charged for then? Only the storage costs associated with the Log Analytics workspace? When doing the costing, do I include only those sources not explicitly mentioned as free connectors?

garybushey · Answer

SebastiaanR&nbsp;You will not get charged for O365 data and the ALERTS coming from the other Azure security products, like MCAS and ATP, and the Azure Activity logs.&nbsp; Go to this page and at the bottom of the page is a FAQ that lists this out.&nbsp; Also, note that the total cost for Azure Sentinel is:1) Azure Sentinel ingestion (which the URL below is for)2) Log Analytics ingestion3) Data retention after 90 days (first 90 days is free no matter where the data come from)&nbsp;https://azure.microsoft.com/en-us/pricing/details/azure-sentinel/&nbsp;You can also go to&nbsp;https://siemsizingcalculator.logpoint.com/&nbsp;to get an idea of how much data you will be ingesting from your environment.

d_aguilar · Answer

Hi&nbsp;SebastiaanR&nbsp; to add to&nbsp;GaryBushey points, you can use this workbook if you choose take Sentinel for a test drive, this will give you an insight on the volume of logs you are receiving, pricing and other useful things.https://techcommunity.microsoft.com/t5/azure-sentinel/usage-reporting-for-azure-sentinel/ba-p/1267383&nbsp;If you are interested in some more info drop me a line, I've deployed a few Sentinel solutions.&nbsp;Kind regardsDiego

sebastiaanr · Answer

Thanks&nbsp;GaryBushey&nbsp;. I actually used that to determine the log sizes earlier today, thanks 🙂Pardon my ignorance,Let's assume I have my LA workspace with Sentinel on top of it. I have a server connected to this same workspace generating 50GB of logs per month. The same workspace is covered under Azure Security Center standard and as such this server is covered by Defender ATP.Am I correct that Sentinel still sees the 50GB as ingested log volumes, and that is what will be counted against the consumption?Thanks&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;

garybushey · Answer

SebastiaanR&nbsp;That is correct.&nbsp;&nbsp;

ofer_shezaf · Answer

GaryBushey&nbsp;,&nbsp;SebastiaanR&nbsp;: To clarify:
&nbsp;
- The free sources Gary mentions above are free for both the Sentinel cost and the Log Analytics ingestion cost. Only Log Analytics retention beyond 90 days is charged.
&nbsp;
- The 500MB/d free consumption allocation for Security Events for systems licensed for ASC standard applies but only to the Log Anaytics ingestion cost and not to the Sentinel cost.&nbsp;

Forum Discussion

Sentinel Cost Estimation

Share

Resources