Azure Sentinel – Average GB per day

Why Average GB per day, it’s because that’s the information the Azure Pricing Calculator needs now that Azure Sentinel is released. This query looks at all billable data in your Log Analytics workspace and takes an average over the period. Example

https://azure.microsoft.com/en-gb/pricing/calculator/

Then search for Sentinel / or look in the Security section.

——————————————————————————————————————


// Clive Watson Microsoft
//
let daystoSearch = 31d; // Please enter how many days worth of data to look at?
union withsource = tt *
| where TimeGenerated > startofday(ago(daystoSearch)) and TimeGenerated < startofday(now())
// Only look at chargeable Tables
| where _IsBillable == True
| summarize
TotalGBytes =round(sum(_BilledSize/(1024*1024*1024)),2)
by bin(TimeGenerated, 1d)//, Solution=tt
| summarize avg(TotalGBytes)


In the demo system, the result is 37GB a day (at the moment).

avg_TotalGBytes
36.75

Now you can add this to the calculator:

For budgeting some might like to add a max figure rather than an average, in that case swap the last line to:

| summarize avg(TotalGBytes), max(TotalGBytes)

You can also just run, part of the query to get a daily graph


let daystoSearch = 31d; // Please enter how many days worth of data to look at?
union withsource = tt *
| where TimeGenerated > startofday(ago(daystoSearch)) and TimeGenerated < startofday(now())
// Only look at chargable Tables
| where _IsBillable == True
| summarize
TotalGBytes =round(sum(_BilledSize/(1024*1024*1024)),2)
by bin(TimeGenerated, 1d)
| render areachart kind=stacked title = "Azure Sentinel billable data"