You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/sentinel/billing.md
+23-22Lines changed: 23 additions & 22 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,18 +1,19 @@
1
1
---
2
-
title: Plan costs for Microsoft Sentinel
3
-
description: Learn how to estimate your costs and billing for Microsoft Sentinel by using the pricing calculator and other methods.
2
+
title: Plan costs, understand Microsoft Sentinel pricing and billing
3
+
description: Learn how to plan your Microsoft Sentinel costs, and understand pricing and billing using the pricing calculator and other methods.
4
4
author: cwatson-cat
5
5
ms.author: cwatson
6
6
ms.custom: subject-cost-optimization
7
7
ms.topic: how-to
8
-
ms.date: 02/22/2022
8
+
ms.date: 07/14/2022
9
+
#Customer intent: As a SOC manager, plan Microsoft Sentinel costs so I can understand and optimize the costs of my SIEM.
9
10
---
10
11
11
-
# Plan costs for Microsoft Sentinel
12
+
# Plan costs and understand Microsoft Sentinel pricing and billing
12
13
13
-
Microsoft Sentinel provides intelligent security analytics across your enterprise. The data for this analysis is stored in an Azure Monitor Log Analytics workspace. Microsoft Sentinel is billed based on the volume of data for analysis in Microsoft Sentinel and storage in the Azure Monitor Log Analytics workspace. For more information, see the [Microsoft Sentinel Pricing Page](https://azure.microsoft.com/pricing/details/microsoft-sentinel/).
14
+
As you plan your Microsoft Sentinel deployment, you typically want to understand the Microsoft Sentinel pricing and billing models, so you can optimize your costs. Microsoft Sentinel security analytics data is stored in an Azure Monitor Log Analytics workspace. Billing is based on the volume of that data in Microsoft Sentinel and the Azure Monitor Log Analytics workspace storage. Learn more about [Microsoft Sentinel pricing](https://azure.microsoft.com/pricing/details/microsoft-sentinel/).
14
15
15
-
Before you add any resources for the Microsoft Sentinel, use the [Azure pricing calculator](https://azure.microsoft.com/pricing/calculator/) to help estimate your costs.
16
+
Before you add any resources for Microsoft Sentinel, use the [Azure pricing calculator](https://azure.microsoft.com/pricing/calculator/) to help estimate your costs.
16
17
17
18
Costs for Microsoft Sentinel are only a portion of the monthly costs in your Azure bill. Although this article explains how to plan costs and understand the billing for Microsoft Sentinel, you're billed for all Azure services and resources your Azure subscription uses, including Partner services.
18
19
@@ -32,12 +33,11 @@ Usage beyond these limits will be charged per the pricing listed on the [Microso
32
33
33
34
During your free trial, find resources for cost management, training, and more on the **News & guides > Free trial** tab in Microsoft Sentinel. This tab also displays details about the dates of your free trial, and how many days you have left until it expires.
34
35
35
-
36
-
## Identify data sources
36
+
## Identify data sources and plan costs accordingly
37
37
38
38
Identify the data sources you're ingesting or plan to ingest to your workspace in Microsoft Sentinel. Microsoft Sentinel allows you to bring in data from one or more data sources. Some of these data sources are free, and others incur charges. For more information, see [Free data sources](#free-data-sources).
39
39
40
-
## Estimate costs before using Microsoft Sentinel
40
+
## Estimate costs and billing before using Microsoft Sentinel
41
41
42
42
If you're not yet using Microsoft Sentinel, you can use the [Microsoft Sentinel pricing calculator](https://azure.microsoft.com/pricing/calculator/?service=azure-sentinel) to estimate potential costs. Enter *Microsoft Sentinel* in the Search box and select the resulting Microsoft Sentinel tile. The pricing calculator helps you estimate your likely costs based on your expected data ingestion and retention.
43
43
@@ -91,15 +91,15 @@ To see your Azure bill, select **Cost Analysis** in the left navigation of **Cos
91
91
92
92
The costs shown in the following image are for example purposes only. They're not intended to reflect actual costs.
93
93
94
-

94
+
:::image type="content" source="media/billing/sample-bill.png" alt-text="Screenshot showing the Microsoft Sentinel section of a sample Azure bill, to help you estimate costs." lightbox="media/billing/data-types.png":::
95
95
96
96
Microsoft Sentinel and Log Analytics charges appear on your Azure bill as separate line items based on your selected pricing plan. If you exceed your workspace's Commitment Tier usage in a given month, the Azure bill shows one line item for the Commitment Tier with its associated fixed cost, and a separate line item for the ingestion beyond the Commitment Tier, billed at your same Commitment Tier rate.
97
97
98
98
The following tabs show how Microsoft Sentinel and Log Analytics costs appear in the **Service name** and **Meter** columns of your Azure bill depending on your pricing tier.
99
99
100
100
#### [Commitment tier](#tab/commitment-tier)
101
101
102
-
If you're billed at the commitment tier rate, the following table shows how Microsoft Sentinel and Log Analytics costs appear in the **Service name** and **Meter** columns of your Azure bill.
102
+
If you're billed at the commitment tier rate, this table shows how Microsoft Sentinel and Log Analytics costs appear in the **Service name** and **Meter** columns of your Azure bill.
103
103
104
104
| Cost description | Service name | Meter |
105
105
|--|--|--|
@@ -112,7 +112,7 @@ If you're billed at the commitment tier rate, the following table shows how Micr
112
112
113
113
#### [Pay-As-You-Go](#tab/pay-as-you-go)
114
114
115
-
If you're billed at Pay-As-You-Go rate, the following table shows how Microsoft Sentinel and Log Analytics costs appear in the **Service name** and **Meter** columns of your Azure bill.
115
+
If you're billed at Pay-As-You-Go rate, this table shows how Microsoft Sentinel and Log Analytics costs appear in the **Service name** and **Meter** columns of your Azure bill.
116
116
117
117
Cost description | Service name | Meter |
118
118
|--|--|--|
@@ -123,7 +123,7 @@ If you're billed at Pay-As-You-Go rate, the following table shows how Microsoft
123
123
124
124
#### [Free data meters](#tab/free-data-meters)
125
125
126
-
The following table shows how Microsoft Sentinel and Log Analytics costs appear in the **Service name** and **Meter** columns of your Azure bill for free data services. For more information, see [View Data Allocation Benefits](../azure-monitor/usage-estimated-costs.md#view-data-allocation-benefits).
126
+
This table shows how Microsoft Sentinel and Log Analytics costs appear in the **Service name** and **Meter** columns of your Azure bill for free data services. For more information, see [View Data Allocation Benefits](../azure-monitor/usage-estimated-costs.md#view-data-allocation-benefits).
127
127
128
128
Cost description | Service name | Meter |
129
129
|--|--|--|
@@ -134,13 +134,13 @@ The following table shows how Microsoft Sentinel and Log Analytics costs appear
134
134
135
135
---
136
136
137
-
For more information on viewing and downloading your Azure bill, see [Azure cost and billing information](../cost-management-billing/understand/download-azure-daily-usage.md).
137
+
Learn how to [view and download your Azure bill](../cost-management-billing/understand/download-azure-daily-usage.md).
138
138
139
-
## Costs for other services
139
+
## Costs and pricing for other services
140
140
141
-
Microsoft Sentinel integrates with many other Azure services to provide enhanced capabilities. These services include Azure Logic Apps, Azure Notebooks, and bring your own machine learning (BYOML) models. Some of these services may have extra charges. Some of Microsoft Sentinel's data connectors and solutions use Azure Functions for data ingestion, which also has a separate associated cost.
141
+
Microsoft Sentinel integrates with many other Azure services, including Azure Logic Apps, Azure Notebooks, and bring your own machine learning (BYOML) models. Some of these services may have extra charges. Some of Microsoft Sentinel's data connectors and solutions use Azure Functions for data ingestion, which also has a separate associated cost.
@@ -151,17 +151,19 @@ Any other services you use could have associated costs.
151
151
152
152
## Data retention and archived logs costs
153
153
154
-
After you enable Microsoft Sentinel on a Log Analytics workspace, you can retain all data ingested into the workspace at no charge for the first 90 days. Retention beyond 90 days is charged per the standard [Log Analytics retention prices](https://azure.microsoft.com/pricing/details/monitor/).
154
+
After you enable Microsoft Sentinel on a Log Analytics workspace:
155
155
156
-
You can specify different retention settings for individual data types. For more information, see [Retention by data type](../azure-monitor/logs/data-retention-archive.md#set-retention-and-archive-policy-by-table). You can also enable long-term retention for your data and have access to historical logs by enabling archived logs. Data archive is a low-cost retention layer for archival storage. It's charged based on the volume of data stored and scanned. For more information, see [Configure data retention and archive policies in Azure Monitor Logs](../azure-monitor/logs/data-retention-archive.md). Archived logs are in public preview.
156
+
- You can retain all data ingested into the workspace at no charge for the first 90 days. Retention beyond 90 days is charged per the standard [Log Analytics retention prices](https://azure.microsoft.com/pricing/details/monitor/).
157
+
- You can specify different retention settings for individual data types. Learn about [retention by data type](../azure-monitor/logs/data-retention-archive.md#set-retention-and-archive-policy-by-table).
158
+
- You can also enable long-term retention for your data and have access to historical logs by enabling archived logs. Data archive is a low-cost retention layer for archival storage. It's charged based on the volume of data stored and scanned. Learn how to [configure data retention and archive policies in Azure Monitor Logs](../azure-monitor/logs/data-retention-archive.md). Archived logs are in public preview.
157
159
158
160
The 90 day retention doesn't apply to basic logs. If you want to extend data retention for basic logs beyond eight days, you can store that data in archived logs for up to seven years.
159
161
160
162
## Other CEF ingestion costs
161
163
162
164
CEF is a supported Syslog events format in Microsoft Sentinel. You can use CEF to bring in valuable security information from various sources to your Microsoft Sentinel workspace. CEF logs land in the CommonSecurityLog table in Microsoft Sentinel, which includes all the standard up-to-date CEF fields.
163
165
164
-
Many devices and data sources allow for logging fields beyond the standard CEF schema. These extra fields land in the AdditionalExtensions table. These fields could have higher ingestion volumes than the standard CEF fields, because the event content within these fields can be variable.
166
+
Many devices and data sources support logging fields beyond the standard CEF schema. These extra fields land in the AdditionalExtensions table. These fields could have higher ingestion volumes than the standard CEF fields, because the event content within these fields can be variable.
165
167
166
168
## Costs that might accrue after resource deletion
167
169
@@ -210,11 +212,10 @@ For data connectors that include both free and paid data types, you can select w
210
212
211
213
:::image type="content" source="media/billing/data-types.png" alt-text="Screenshot of the Data connector page for Defender for Cloud Apps, with the free security alerts selected and the paid M C A S Shadow I T Reporting not selected." lightbox="media/billing/data-types.png":::
212
214
213
-
For more information about free and paid data sources and connectors, see [Connect data sources](connect-data-sources.md).
215
+
Learn more about how to [connect data sources](connect-data-sources.md), including free and paid data sources.
214
216
215
217
Data connectors listed as public preview don't generate cost. Data connectors generate cost only once becoming Generally Available (GA).
216
218
217
-
218
219
## Next steps
219
220
220
221
-[Monitor costs for Microsoft Sentinel](billing-monitor-costs.md)
0 commit comments