Azure Sentinel with Basic logs table

Question

Azure Sentinel with Basic logs table

Sepski, Krzysztof 0

Hi,
I am using Log analytics workspace in which I have one Basic plan table.
How to correctly calculate cost of Azure Sentinel analyzing basic logs table?

0 comments

1 answer

Your answer

Answer 1

Marcin Policht 111.8K MVP Volunteer Moderator

This involves two distinct components: data ingestion and query or search execution. Additional charges may apply for long-term retention beyond the included retention period.

Under Microsoft Sentinel's simplified pricing model, Basic Logs are billed using dedicated Sentinel and Azure Monitor meters rather than standard Analytics table pricing. In particular, Basic Logs ingestion is billed at approximately $1.00 per GB at the regional Pay-As-You-Go rate, depending on the Azure region. The ingestion cost is calculated by multiplying the daily ingested data volume in GB by the number of days and the applicable per-GB rate. Billable data volume is calculated from the string representation of the columns written and is often approximately 25% smaller than the raw incoming JSON size. Basic Logs include 30 days of interactive retention at no additional charge.

Running interactive KQL queries or searches against Basic Logs tables incurs a scan charge of approximately $0.005 per GB of data scanned. The query cost is calculated by multiplying the total volume scanned by the applicable per-GB rate. Because Basic Logs do not support the full range of Analytics features, costs depend on how frequently queries run and how much data they scan.

If you retain data beyond the included 30-day interactive retention period, additional long-term retention charges may apply. Depending on the retention configuration and applicable pricing, these charges may be approximately $0.02 to $0.023 per GB per month. Retention limits and pricing depend on the specific Azure Monitor table plan and configuration.

To view your actual costs in the Azure portal, navigate to your Log Analytics workspace and select Settings, then Usage and estimated costs, to review data volumes. You can also open Cost Analysis for the resource group containing Microsoft Sentinel and Log Analytics, then filter by resource, service name, or meter to identify the applicable Sentinel and Log Analytics charges.

If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

hth

Marcin

Sepski, Krzysztof 0 Reputation points

2026-10-27T11:47:09.9566667+00:00

Still I am not sure. How should I look at queries on Basic Logs created by Sentinel Analytics Rules?
Marcin Policht 111.8K Reputation points MVP Volunteer Moderator

2026-10-27T14:29:47.5233333+00:00
AFAIK, scheduled analytics rules cannot query Basic Logs tables directly. If you attempt to save a scheduled analytics rule that references a Basic Logs table, Microsoft Sentinel will prevent the rule from being created or saved. Scheduled analytics rules require data in the Analytics plan to support scheduled detection and alerting. Note that Basic Logs also have limitations on query capabilities compared with Analytics tables.

Because scheduled analytics rules cannot query Basic Logs directly, there are no scheduled analytics rule scan charges to look for on those tables.

If you need Microsoft Sentinel analytics rules to process data currently stored in a Basic Logs table, one option is to change the table's plan to Analytics. This allows scheduled analytics rules to query the data, but ingestion is billed at the applicable Analytics pricing rather than the lower Basic Logs ingestion rate. Standard Analytics queries used by scheduled analytics rules do not incur the separate Basic Logs per-GB scan charge.

Alternatively, you can retain the Basic plan and use Sentinel Search Jobs for ad hoc threat hunting. A Search Job searches the Basic Logs data and writes matching results to a search results table, generally using the _SRCH suffix. The costs include the Basic Logs scan charge of approximately $0.005 per GB scanned and Analytics ingestion charges for the results written to the search results table. You can then query those results using supported Analytics features. Search Jobs are intended for historical investigation rather than as a direct replacement for scheduled analytics rules operating continuously on Basic Logs.

To audit manual queries against Basic Logs tables, you can use the LAQueryLogs table if query auditing is enabled in the Log Analytics workspace diagnostic settings. The following KQL query filters query records by a table name and displays the query time, user identity, response rows, response size, and query text.

LAQueryLogs | where QueryText has "YourBasicTableNameHere" | project TimeGenerated, AADEmail, ResponseRows, ResponseBytes, QueryText | extend GBScanned = ResponseBytes / 1024 / 1024 / 1024

Replace YourBasicTableNameHere with the actual table name. The GBScanned calculation above converts ResponseBytes to GiB, not decimal GB, and response size should not be treated as a definitive measure of billable data scanned. Keep in mind though that LAQueryLogs records interactive query activity when configured, but it does not provide a complete audit of every automated workflow or a direct accounting of all Basic Logs scan charges.

If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

hth

Marcin