Worried about the cost of Sentinel? 3 points to keep Log Analytics costs down

• Too many logs and costs jump at the end of the month
• But I don't know what to cut

For such people, this article will explain in an easy-to-understand manner "3 practical points to keep Sentinel costs down without difficulty".

1. Review how Log Analytics billing works

Sentinel is built on "Log Analytics" and is charged for the following two main points.

In other words, "too much and too much storage" is the cause of the increase in costs.

2. Cost Saving Point 1: Don't Put Unnecessary Logs in the First Place

Microsoft Sentinel charges you from the moment you ingest logs.
In other words, if you put anything in it that you might use later, that alone will increase the cost.

By selecting and ingesting only the logs you need, you can prevent waste.

For example, there are the following cases.

• It is enough to capture only the "error" of the server, but it is up to the "information level".
• Windows monitoring logs also collect "all types" even though they only need to be "security-related".

In these cases, it is easier to narrow down the logs you take at the beginning than to reduce them later.

You can choose which logs to get in the diagnostic settings in the Azure portal.

3. Cost Saving Point 2: Reduce Retention Period per Table

The default retention period for Log Analytics is 90 days.
But you don't need to keep all your logs for 90 days.

For example, 'Heartbeat' or 'Syslog' may be sufficient for 14 days.
On the other hand, use 'SecurityAlert' or 'SigninLogs' to store anything that should be left as an audit or trail for a longer period of time.

Setup Steps:

1. Open the Log Analytics workspace
2. Select an object from the "Table" list
3. Change the number of days in "Configure retention period"

4. Cost Saving Point 3: Visualize the spike log with monthly reports

If you notice a spike in logs early, you can deal with it within the month.

For example, you can use the following query to understand the amount ingested on a daily basis.

Usage
| summarize DailyIngestGB = sum(Quantity) by bin(TimeGenerated, 1d)
| order by TimeGenerated desc

You can save this query in your workbook to get a visual view of trends in log volume.
In addition, you can integrate with Logic Apps to automate monthly notifications.

5. Summary: 3 Steps to Keep Costs Down

1. Don't put unnecessary logs -> Select and import only the logs you need in the first configuration
2. Shorten the retention period -> Review the retention period for each table and set the shortening setting
3. Visualize the spike log -> Regularly check the daily ingestion amount and try to respond as soon as possible.

While strengthening security, unnecessary costs are firmly reduced.
To achieve this, the key points are "visualization" and "pre-design".

If you are looking for help optimizing your operations, please feel free to contact Colorkrew Security.