Make system-generated LogARepublisher Threat Intelligence updates non-billable (_IsBillable = false)
Problem Statement: Currently, Microsoft Sentinel regularly reruns an internal background process called LogARepublisher. This process periodically republishes existing Threat Intelligence data into the ThreatIntelIndicators table on an ongoing 7-to-10 day cycle to maintain freshness. Because these system-generated updates write new records into the workspace, they are flagged as _IsBillable = true. This results in organizations paying multiple times for the exact same threat indicators over their lifecycle. In general, this is a small amount of data but can form a larger percentage of ingest/analytic cost for customers with low ingestion volumes, and becomes noticeable at scale when managing many Azure tenants. Why This Matters: Unintended Cost Allocation: Customers are being billed for automated, backend data-maintenance cycles triggered by Microsoft, rather than true new log ingestion or external feed consumption. Artificial Volume Inflation: Large TI datasets can exponentially inflate monthly data volume metrics solely due to repeating republication, making budget forecasting unpredictable. No Added Analytical Value: Rerunning the exact same indicators does not offer new security value or unique logs; it simply updates the timestamp metadata on a new row. Proposed Solution: Modify the backend pipeline so that when a record is ingested via LastUpdateMethod == "LogARepublisher", the system-generated metadata property _IsBillable is automatically set to false. Customers should only be billed for the initial ingestion of a threat indicator, not for the automated system maintenance required to keep it fresh within the Sentinel ecosystem.