Skip to content

Commit 7cd1039

Browse files
committed
Updating pricing article (content bash)
1 parent 1630c8c commit 7cd1039

File tree

1 file changed

+23
-22
lines changed

1 file changed

+23
-22
lines changed

articles/sentinel/billing.md

Lines changed: 23 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -1,18 +1,19 @@
11
---
2-
title: Plan costs for Microsoft Sentinel
3-
description: Learn how to estimate your costs and billing for Microsoft Sentinel by using the pricing calculator and other methods.
2+
title: Plan costs, understand Microsoft Sentinel pricing and billing
3+
description: Learn how to plan your Microsoft Sentinel costs, and understand pricing and billing using the pricing calculator and other methods.
44
author: cwatson-cat
55
ms.author: cwatson
66
ms.custom: subject-cost-optimization
77
ms.topic: how-to
8-
ms.date: 02/22/2022
8+
ms.date: 07/14/2022
9+
#Customer intent: As a SOC manager, plan Microsoft Sentinel costs so I can understand and optimize the costs of my SIEM.
910
---
1011

11-
# Plan costs for Microsoft Sentinel
12+
# Plan costs and understand Microsoft Sentinel pricing and billing
1213

13-
Microsoft Sentinel provides intelligent security analytics across your enterprise. The data for this analysis is stored in an Azure Monitor Log Analytics workspace. Microsoft Sentinel is billed based on the volume of data for analysis in Microsoft Sentinel and storage in the Azure Monitor Log Analytics workspace. For more information, see the [Microsoft Sentinel Pricing Page](https://azure.microsoft.com/pricing/details/microsoft-sentinel/).
14+
As you plan your Microsoft Sentinel deployment, you typically want to understand the Microsoft Sentinel pricing and billing models, so you can optimize your costs. Microsoft Sentinel security analytics data is stored in an Azure Monitor Log Analytics workspace. Billing is based on the volume of that data in Microsoft Sentinel and the Azure Monitor Log Analytics workspace storage. Learn more about [Microsoft Sentinel pricing](https://azure.microsoft.com/pricing/details/microsoft-sentinel/).
1415

15-
Before you add any resources for the Microsoft Sentinel, use the [Azure pricing calculator](https://azure.microsoft.com/pricing/calculator/) to help estimate your costs.
16+
Before you add any resources for Microsoft Sentinel, use the [Azure pricing calculator](https://azure.microsoft.com/pricing/calculator/) to help estimate your costs.
1617

1718
Costs for Microsoft Sentinel are only a portion of the monthly costs in your Azure bill. Although this article explains how to plan costs and understand the billing for Microsoft Sentinel, you're billed for all Azure services and resources your Azure subscription uses, including Partner services.
1819

@@ -32,12 +33,11 @@ Usage beyond these limits will be charged per the pricing listed on the [Microso
3233

3334
During your free trial, find resources for cost management, training, and more on the **News & guides > Free trial** tab in Microsoft Sentinel. This tab also displays details about the dates of your free trial, and how many days you have left until it expires.
3435

35-
36-
## Identify data sources
36+
## Identify data sources and plan costs accordingly
3737

3838
Identify the data sources you're ingesting or plan to ingest to your workspace in Microsoft Sentinel. Microsoft Sentinel allows you to bring in data from one or more data sources. Some of these data sources are free, and others incur charges. For more information, see [Free data sources](#free-data-sources).
3939

40-
## Estimate costs before using Microsoft Sentinel
40+
## Estimate costs and billing before using Microsoft Sentinel
4141

4242
If you're not yet using Microsoft Sentinel, you can use the [Microsoft Sentinel pricing calculator](https://azure.microsoft.com/pricing/calculator/?service=azure-sentinel) to estimate potential costs. Enter *Microsoft Sentinel* in the Search box and select the resulting Microsoft Sentinel tile. The pricing calculator helps you estimate your likely costs based on your expected data ingestion and retention.
4343

@@ -91,15 +91,15 @@ To see your Azure bill, select **Cost Analysis** in the left navigation of **Cos
9191

9292
The costs shown in the following image are for example purposes only. They're not intended to reflect actual costs.
9393

94-
![Screenshot showing the Microsoft Sentinel section of a sample Azure bill.](media/billing/sample-bill.png)
94+
:::image type="content" source="media/billing/sample-bill.png" alt-text="Screenshot showing the Microsoft Sentinel section of a sample Azure bill, to help you estimate costs." lightbox="media/billing/data-types.png":::
9595

9696
Microsoft Sentinel and Log Analytics charges appear on your Azure bill as separate line items based on your selected pricing plan. If you exceed your workspace's Commitment Tier usage in a given month, the Azure bill shows one line item for the Commitment Tier with its associated fixed cost, and a separate line item for the ingestion beyond the Commitment Tier, billed at your same Commitment Tier rate.
9797

9898
The following tabs show how Microsoft Sentinel and Log Analytics costs appear in the **Service name** and **Meter** columns of your Azure bill depending on your pricing tier.
9999

100100
#### [Commitment tier](#tab/commitment-tier)
101101

102-
If you're billed at the commitment tier rate, the following table shows how Microsoft Sentinel and Log Analytics costs appear in the **Service name** and **Meter** columns of your Azure bill.
102+
If you're billed at the commitment tier rate, this table shows how Microsoft Sentinel and Log Analytics costs appear in the **Service name** and **Meter** columns of your Azure bill.
103103

104104
| Cost description | Service name | Meter |
105105
|--|--|--|
@@ -112,7 +112,7 @@ If you're billed at the commitment tier rate, the following table shows how Micr
112112

113113
#### [Pay-As-You-Go](#tab/pay-as-you-go)
114114

115-
If you're billed at Pay-As-You-Go rate, the following table shows how Microsoft Sentinel and Log Analytics costs appear in the **Service name** and **Meter** columns of your Azure bill.
115+
If you're billed at Pay-As-You-Go rate, this table shows how Microsoft Sentinel and Log Analytics costs appear in the **Service name** and **Meter** columns of your Azure bill.
116116

117117
Cost description | Service name | Meter |
118118
|--|--|--|
@@ -123,7 +123,7 @@ If you're billed at Pay-As-You-Go rate, the following table shows how Microsoft
123123

124124
#### [Free data meters](#tab/free-data-meters)
125125

126-
The following table shows how Microsoft Sentinel and Log Analytics costs appear in the **Service name** and **Meter** columns of your Azure bill for free data services. For more information, see [View Data Allocation Benefits](../azure-monitor/usage-estimated-costs.md#view-data-allocation-benefits).
126+
This table shows how Microsoft Sentinel and Log Analytics costs appear in the **Service name** and **Meter** columns of your Azure bill for free data services. For more information, see [View Data Allocation Benefits](../azure-monitor/usage-estimated-costs.md#view-data-allocation-benefits).
127127

128128
Cost description | Service name | Meter |
129129
|--|--|--|
@@ -134,13 +134,13 @@ The following table shows how Microsoft Sentinel and Log Analytics costs appear
134134

135135
---
136136

137-
For more information on viewing and downloading your Azure bill, see [Azure cost and billing information](../cost-management-billing/understand/download-azure-daily-usage.md).
137+
Learn how to [view and download your Azure bill](../cost-management-billing/understand/download-azure-daily-usage.md).
138138

139-
## Costs for other services
139+
## Costs and pricing for other services
140140

141-
Microsoft Sentinel integrates with many other Azure services to provide enhanced capabilities. These services include Azure Logic Apps, Azure Notebooks, and bring your own machine learning (BYOML) models. Some of these services may have extra charges. Some of Microsoft Sentinel's data connectors and solutions use Azure Functions for data ingestion, which also has a separate associated cost.
141+
Microsoft Sentinel integrates with many other Azure services, including Azure Logic Apps, Azure Notebooks, and bring your own machine learning (BYOML) models. Some of these services may have extra charges. Some of Microsoft Sentinel's data connectors and solutions use Azure Functions for data ingestion, which also has a separate associated cost.
142142

143-
For pricing details for these services, see:
143+
Learn about pricing for these services:
144144

145145
- [Automation-Logic Apps pricing](https://azure.microsoft.com/pricing/details/logic-apps/)
146146
- [Notebooks pricing](https://azure.microsoft.com/pricing/details/machine-learning/)
@@ -151,17 +151,19 @@ Any other services you use could have associated costs.
151151

152152
## Data retention and archived logs costs
153153

154-
After you enable Microsoft Sentinel on a Log Analytics workspace, you can retain all data ingested into the workspace at no charge for the first 90 days. Retention beyond 90 days is charged per the standard [Log Analytics retention prices](https://azure.microsoft.com/pricing/details/monitor/).
154+
After you enable Microsoft Sentinel on a Log Analytics workspace:
155155

156-
You can specify different retention settings for individual data types. For more information, see [Retention by data type](../azure-monitor/logs/data-retention-archive.md#set-retention-and-archive-policy-by-table). You can also enable long-term retention for your data and have access to historical logs by enabling archived logs. Data archive is a low-cost retention layer for archival storage. It's charged based on the volume of data stored and scanned. For more information, see [Configure data retention and archive policies in Azure Monitor Logs](../azure-monitor/logs/data-retention-archive.md). Archived logs are in public preview.
156+
- You can retain all data ingested into the workspace at no charge for the first 90 days. Retention beyond 90 days is charged per the standard [Log Analytics retention prices](https://azure.microsoft.com/pricing/details/monitor/).
157+
- You can specify different retention settings for individual data types. Learn about [retention by data type](../azure-monitor/logs/data-retention-archive.md#set-retention-and-archive-policy-by-table).
158+
- You can also enable long-term retention for your data and have access to historical logs by enabling archived logs. Data archive is a low-cost retention layer for archival storage. It's charged based on the volume of data stored and scanned. Learn how to [configure data retention and archive policies in Azure Monitor Logs](../azure-monitor/logs/data-retention-archive.md). Archived logs are in public preview.
157159

158160
The 90 day retention doesn't apply to basic logs. If you want to extend data retention for basic logs beyond eight days, you can store that data in archived logs for up to seven years.
159161

160162
## Other CEF ingestion costs
161163

162164
CEF is a supported Syslog events format in Microsoft Sentinel. You can use CEF to bring in valuable security information from various sources to your Microsoft Sentinel workspace. CEF logs land in the CommonSecurityLog table in Microsoft Sentinel, which includes all the standard up-to-date CEF fields.
163165

164-
Many devices and data sources allow for logging fields beyond the standard CEF schema. These extra fields land in the AdditionalExtensions table. These fields could have higher ingestion volumes than the standard CEF fields, because the event content within these fields can be variable.
166+
Many devices and data sources support logging fields beyond the standard CEF schema. These extra fields land in the AdditionalExtensions table. These fields could have higher ingestion volumes than the standard CEF fields, because the event content within these fields can be variable.
165167

166168
## Costs that might accrue after resource deletion
167169

@@ -210,11 +212,10 @@ For data connectors that include both free and paid data types, you can select w
210212

211213
:::image type="content" source="media/billing/data-types.png" alt-text="Screenshot of the Data connector page for Defender for Cloud Apps, with the free security alerts selected and the paid M C A S Shadow I T Reporting not selected." lightbox="media/billing/data-types.png":::
212214

213-
For more information about free and paid data sources and connectors, see [Connect data sources](connect-data-sources.md).
215+
Learn more about how to [connect data sources](connect-data-sources.md), including free and paid data sources.
214216

215217
Data connectors listed as public preview don't generate cost. Data connectors generate cost only once becoming Generally Available (GA).
216218

217-
218219
## Next steps
219220

220221
- [Monitor costs for Microsoft Sentinel](billing-monitor-costs.md)

0 commit comments

Comments
 (0)