Microsoft Sentinel Pricing Explained

[@charliejones8897]

very helpful, thanks.

[@Cyber-Check]

Thank you. I appreciate the feedback and kind message!

[@supajo]

Is the 500MB from Defender for Cloud P2 for all Data or just for some? Thinking of having many Cloud P2 Servers

[@Cyber-Check]

It's only for some. For example custom data from a file won't count into this. To be said, most of them are supported and if you are already ingesting GBs of data each day, this allowance will drop your cost. Here is supported data list: SecurityAlert SecurityBaseline SecurityBaselineSummary SecurityDetection SecurityEvent WindowsFirewall SysmonEvent ProtectionStatus Update and UpdateSummary when the Update Management solution isn't running in the workspace or solution targeting is enabled. Doc: learn.microsoft.com/en-us/azure/defender-for-cloud/faq-defender-for-servers#what-data-types-are-included-in-the-daily-allowance-

[@supajo]

@@Cyber-Check thanks for your explanation 👍 i was hoping of custom data but now i understand where the main benefit is

[@5e88e]

So the amount of storage accounts doesnt matter? Heard something that having more deployed storage accounts will be more expencive.

[@Cyber-Check]

This will depend if you are trying to send the audit logs from storage accounts. In the case you priced for every GB of data. More storage accounts = more transactions = more logs = bigger price for ingested data.

[@anantP-ip8op]

Hey, awaiting your new course on udemy. #sentinel

[@Cyber-Check]

Hello, working on it! ;)