Make system-generated LogARepublisher Threat Intelligence updates non-billable (_IsBillable = false)

mtwexp — Mon, 31 Aug 2026 00:26:47 GMT

Problem Statement:

Currently, Microsoft Sentinel regularly reruns an internal background process called LogARepublisher. This process periodically republishes existing Threat Intelligence data into the ThreatIntelIndicators table on an ongoing 7-to-10 day cycle to maintain freshness.

Because these system-generated updates write new records into the workspace, they are flagged as _IsBillable = true. This results in organizations paying multiple times for the exact same threat indicators over their lifecycle. In general, this is a small amount of data but can form a larger percentage of ingest/analytic cost for customers with low ingestion volumes, and becomes noticeable at scale when managing many Azure tenants.

Why This Matters:

Unintended Cost Allocation: Customers are being billed for automated, backend data-maintenance cycles triggered by Microsoft, rather than true new log ingestion or external feed consumption.

Artificial Volume Inflation: Large TI datasets can exponentially inflate monthly data volume metrics solely due to repeating republication, making budget forecasting unpredictable.

No Added Analytical Value: Rerunning the exact same indicators does not offer new security value or unique logs; it simply updates the timestamp metadata on a new row.

Proposed Solution:

Modify the backend pipeline so that when a record is ingested via LastUpdateMethod == "LogARepublisher", the system-generated metadata property _IsBillable is automatically set to false.

Customers should only be billed for the initial ingestion of a threat indicator, not for the automated system maintenance required to keep it fresh within the Sentinel ecosystem.

Microsoft Sentinel Ideas Ideas

Make system-generated LogARepublisher Threat Intelligence updates non-billable (_IsBillable = false)