Merge pull request #219671 from danielledennis/patch-5

Create understanding-billable-assets.md

Author: BCS2022

articles/external-attack-surface-management/TOC.yml

@@ -15,11 +15,13 @@
     href: understanding-dashboards.md
   - name: Using and managing discovery
     href: using-and-managing-discovery.md
+  - name: Understand billable assets
+    href: understanding-billable-assets.md
 - name: Quickstart
   items:
   - name: Deploying the Defender EASM Azure resource
     href: deploying-the-defender-easm-azure-resource.md
 - name: Tutorials
   items:
   - name: Discovering your attack surface
-    href: discovering-your-attack-surface.md
+    href: discovering-your-attack-surface.md

articles/external-attack-surface-management/media/billable-1.png

@@ -0,0 +1,96 @@
+---
+title: Understand billable assets
+titleSuffix: Understand billable assets in Microsoft Defender EASM 
+description: This article describes how users will be billed for their Defender EASM resource usage, and guides them to the dashboard that displays their counts. 
+author: danielledennis
+ms.author: dandennis
+ms.service: security
+ms.date: 11/28/2022
+ms.topic: how-to
+---
+
+# Understand billable assets
+
+When customers create their first Microsoft Defender External Attack Surface Management (Defender EASM) resource, they are automatically granted a 30-day free trial.  Once the trial has completed, customers will automatically be charged based on their count of billable assets.   The charged amount will appear on their core Azure billing, with “Defender EASM” appearing as separate line item on their invoice.
+
+
+## What is a billable asset? 
+
+The following kinds of assets are considered billable:  
+
+- Approved hosts 
+- Approved domains 
+- Approved IP addresses 
+  
+  
+Assets are only categorized as billable if they have been placed in the Approved Inventory state.  We do not charge for any other state. Additionally, duplicative host assets are NOT included in the billable asset count.  
+
+
+
+## Calculating billable assets 
+
+This section describes the conditions that the three asset types listed above must meet to be deemed billable.  The sum of these billable asset counts comprises your total number of billable assets and thus determines the cost of your subscription.  
+
+
+
+### Approved hosts 
+
+Hosts are considered billable if the Defender EASM system has observed resolutions within the last 30 days. All host-IP combinations from Approved Inventory will be identified as potential billable assets.  
+
+ 
+For example: if www.contoso.com has resolved to 1.2.3.4 and 5.6.7.8 in the past 30 days, both combinations will be added to the host count list: 
+
+- www.contoso.com / 1.2.3.4 
+- www.contoso.com / 5.6.7.8 
+
+
+The list is then analyzed to identify duplicate entries and eliminate duplicate hosts.  If a host is a subdomain of a parent host that resolves to the same IP address, we will exclude the child from the billable host count. For example, if both www.contoso.com and contoso.com resolve to 1.2.3.4, then we will exclude www.contoso.com/ 1.2.3.4 from our Host Count list. 
+
+
+
+### Approved IP addresses 
+
+Excluding the IP addresses that resolve to a billable resolving host, all active IP addresses in the Approved Inventory state will be part of the billable IP address count.  
+ 
+For an IP address to be considered active and therefore billable, it must have one of the following:  
+
+- a recent detected open port  
+- a recent detected SSL certificate 
+- recently appeared on a reputation list 
+
+
+These values are all considered “recent” if observed within the last 30 days. 
+
+
+
+### Approved domains 
+
+Excluding the domains associated with a billable resolving host, all domains in the Approved Inventory state will be part of the billable domain count. If a billable host is registered to the domain in question, the domain will not be included in the billable asset count.  
+
+For example: if server1.contoso.com has recently resolved to an IP address and is therefore included in your billable asset count, then contoso.com will not be added to this count.   
+
+
+## Viewing billable asset data 
+
+Users can view their billable assets count within their Defender EASM resource to better understand how Microsoft determines their pricing. This dashboard displays the total number of assets that are billable and therefore comprise your total spend. Users should expect to see counts from the last 30 days when applicable, excluding the most recent couple days that have not yet processed.   
+
+Prospective customers accessing Defender EASM with a 30-day trial can also see these billable asset counts. Although these users are not charged until the trial has expired, they can view the billable asset dashboard to better understand how they would be billed according to the size of their attack surface.  
+1. From the Defender EASM resource, select **Billable assets** from the **Manage** section of the left-hand navigation menu.
+
+
+![Screenshot of Billable assets dashboard with left-hand Manage section highlighted in navigation pane.](media/billable-1.png)
+
+
+2. The chart displays billable asset counts over the past 30 days (if we have 30 days of data). The individual bars are segmented by asset type so users can quickly understand how their billable assets are distributed across their attack surface. Users can view the daily counts for each kind of asset by hovering their mouse over the chart. 
+
+![Screenshot of Billable assets chart showing asset counts when hovering over bar.](media/billable-2.png)
+
+
+3. Beneath the chart, users can view their current billable asset counts. These numbers are useful when approximating your monthly spend to best protect your organization’s attack surface.  
+
+![Screenshot of Billable assets counts beneath dashboard.](media/billable-3.png)
+
+
+## Next steps 
+
+- [Microsoft Defender External Attack Surface Management (Defender EASM) overview](index.md)