getting started with Sentinel free data sources

Question

Hi,

Looking at how my org could potentially start to make use of Sentinel, and personally see the free data sources https://learn.microsoft.com/en-us/azure/sentinel/billing?tabs=commitment-tier#free-data-sources as a great place to start getting familiar with the tool without a bill shock.

The link doc states:

I understand that the overall cost for Sentinel is Sentinel ingestion + Log Analytics ingestion + retention beyond the free 90 days.

I also came across that the _IsBillable column in Log Analytics specifies whether ingested data is billable. Data with _IsBillable equal to false are collected for free and not billed to your Azure account (source: https://learn.microsoft.com/en-us/azure/azure-monitor/logs/log-standard-columns#_isbillable )

The question then is, taking into consideration that the Azure Activity Logs are free for Sentinel, the query above, are they exempted from Log Analytics ingestion costs as well? If, that is true, then the “only” cost would be basically the retention for 9 months if I’d like to store them for 1 year. Correct?

Now, what about the Office 365 Audit Logs ? There’s a Sentinel connector for it – logs are written to the OfficeActivity table (source https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/officeactivity). However, since I’m not exporting the logs to a Log Analytics workspace yet (as it is the case with the Azure Activity Logs), how could I check whether they are exempted from Log Analytics ingestion cost as well (or basically, how would I check this for any other table?). The closest to answer this I was able to find is https://learn.microsoft.com/en-us/azure/azure-monitor/logs/analyze-usage#querying-for-data-volumes-excluding-known-free-data-types (the query makes use of a KQL function to list supposedly all tables that are NOT billable). Aby other way, place to check this up?

Any other advice to get starting with Sentinel to not break the budget but yet getting value ?

Appreciate all inputs !

Answer 1

Free sources are free, remember they are only ingested and written to Log Analytics once. e.g. In log analytics you ingest "AzureActivity" its therefore free for Sentinel to analyse (Isbillable==false).

Your first link has the named Tables that are free including the OfficeActivity one. So yes that is free.

However If you adjust retention beyond 30days for Log Analytics only (e.g. when used without Sentinel) or 90+ days when Sentinel is enabled on a Workspace, then you do have retention charges on the free data.
You can estimate those costs with the Licensing Calculator https://azure.microsoft.com/en-us/pricing/calculator/ --> Sentinel