Azure Sentinel free ingestion data : is ingestion also free in Log Analytics ?

Question

Hello,

simple but yet tricky question : some data are free to ingest in Sentinel such as Office Activity or Alerts. Does "free" means "really free" or does it mean "free in Sentinel but billable in Log analytics" ?

Regards,

P. Augras

Answer 1

Hi,
Azure Sentinel uses Log Analytics as platform for storing data. As such it adopts the billing and pricing for Log Analytics. Because of that Sentinel does not change the billing of Log Analytics. This means that any data that is free for Log Analytics is free for Sentinel and vice versa. You can check the official documentation for queries that lists data and if it is billable. For example, by modifying one of the queries to:

Usage   
| where TimeGenerated > ago(32d)  
| where StartTime >= startofday(ago(31d)) and EndTime < startofday(now())  
| where IsBillable == false  
| summarize BillableDataGB = sum(Quantity) / 1000. by bin(StartTime, 1d), DataType   
| render columnchart  

You can get data volume by type for data that is not billable.

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.