Retention log

Roberto D'Andrea 20 Reputation points
2024-03-12T14:29:02.9133333+00:00

Hi all,

I would like to know some information about the Sentinel log ingestion pricing.

My goal is to increase this period to 1 year.

What I read is the possibility not to ingest that log (saving money) but to use the archived period to store these logs.

  1. Can anyone explain how the total retention period works?

If we enable this option and increase it to 1 year, will we pay 0.03€ for GB ingested? (Region: France Central)

  1. If we would like to restore this log we can pay only 0.13€ for GB for the amount of log to restore (multiply the amount of data by the number of data to restore).

Thank you

Azure Cost Management
Azure Cost Management
A Microsoft offering that enables tracking of cloud usage and expenditures for Azure and other cloud providers.
2,047 questions
Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
986 questions
Accepted answer
  1. AnuragSingh-MSFT 20,101 Reputation points
    2024-03-14T06:32:41.59+00:00

    Roberto D'Andrea, thank you for the reply.

    The archival will happen after the ingestion. By default, all tables in your workspace inherit the workspace's interactive retention setting and have no archive. You can modify the retention and archive settings of individual tables. To summarize, the data ingested is available for interactive query for a minimum of 30 days. Based on your archival setting, the data older than 30 days are archived which are available for restoration later for querying.

    For more details, see Data retention and archive in Azure Monitor Logs.

    Hope this helps.

    If the answer did not help, please add more context/follow-up question for it. Else, if the answer helped, please click Accept answer so that it can help others in the community looking for help on similar topics.

1 additional answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Clive Watson 5,716 Reputation points MVP
    2024-03-12T16:49:21.7833333+00:00

    Hello,

    The Azure pricing calculator will help https://azure.microsoft.com/en-us/pricing/calculator/

    User's image

    Use it to compare the options based on your ingestion

    Also read: https://azure.microsoft.com/en-us/pricing/details/monitor/

    NOTE: Restore is for 2TB, so factor that in if your are going to restore often.

    User's image

    So when you compare the two, then factor in some restores
    User's image

    One restore a month could be a similar cost as the normal retention

    User's image