Reduce costs for Microsoft Sentinel (2024)

Article
07/05/2023

Costs for Microsoft Sentinel are only a portion of the monthly costs in your Azure bill. Although this article explains how to reduce costs for Microsoft Sentinel, you're billed for all Azure services and resources your Azure subscription uses, including Partner services.

Set or change pricing tier

To optimize for highest savings, monitor your ingestion volume to ensure you have the Commitment Tier that aligns most closely with your ingestion volume patterns. Consider increasing or decreasing your Commitment Tier to align with changing data volumes.

You can increase your Commitment Tier anytime, which restarts the 31-day commitment period. However, to move back to Pay-As-You-Go or to a lower Commitment Tier, you must wait until after the 31-day commitment period finishes. Billing for Commitment Tiers is on a daily basis.

To see your current Microsoft Sentinel pricing tier, select Settings in the Microsoft Sentinel left navigation, and then select the Pricing tab. Your current pricing tier is marked Current tier.

To change your pricing tier commitment, select one of the other tiers on the pricing page, and then select Apply. You must have Contributor or Owner role in Microsoft Sentinel to change the pricing tier.

Separate non-security data in a different workspace

Microsoft Sentinel analyzes all the data ingested into Microsoft Sentinel-enabled Log Analytics workspaces. It's best to have a separate workspace for non-security operations data, to ensure it doesn't incur Microsoft Sentinel costs.

When hunting or investigating threats in Microsoft Sentinel, you might need to access operational data stored in these standalone Azure Log Analytics workspaces. You can access this data by using cross-workspace querying in the log exploration experience and workbooks. However, you can't use cross-workspace analytics rules and hunting queries unless Microsoft Sentinel is enabled on all the workspaces.

Turn on basic logs data ingestion for data that's high-volume low security value (preview)

Unlike analytics logs, basic logs are typically verbose. They contain a mix of high volume and low security value data, that isn't frequently used or accessed on demand for ad-hoc querying, investigations and search. Enable basic log data ingestion at a significantly reduced cost for eligible data tables. For more information, see Microsoft Sentinel Pricing.

Optimize Log Analytics costs with dedicated clusters

If you ingest at least 500 GB into your Microsoft Sentinel workspace or workspaces in the same region, consider moving to a Log Analytics dedicated cluster to decrease costs. A Log Analytics dedicated cluster Commitment Tier aggregates data volume across workspaces that collectively ingest a total of 500 GB or more.

Reduce long-term data retention costs with Azure Data Explorer or archived logs (preview)

Microsoft Sentinel data retention is free for the first 90 days. To adjust the data retention period in Log Analytics, select Usage and estimated costs in the left navigation, then select Data retention, and then adjust the slider.

Microsoft Sentinel security data might lose some of its value after a few months. Security operations center (SOC) users might not need to access older data as frequently as newer data, but still might need to access the data for sporadic investigations or audit purposes.

To help you reduce Microsoft Sentinel data retention costs, Azure Monitor now offers archived logs. Archived logs store log data for long periods of time, up to seven years, at a reduced cost with limitations on its usage. Archived logs are in public preview. For more information, see Configure data retention and archive policies in Azure Monitor Logs.

Alternatively, you can use Azure Data Explorer for long-term data retention at lower cost. Azure Data Explorer provides the right balance of cost and usability for aged data that no longer needs Microsoft Sentinel security intelligence.

With Azure Data Explorer, you can store data at a lower price, but still explore the data using the same Kusto Query Language (KQL) queries as in Microsoft Sentinel. You can also use the Azure Data Explorer proxy feature to do cross-platform queries. These queries aggregate and correlate data spread across Azure Data Explorer, Application Insights, Microsoft Sentinel, and Log Analytics.

For more information, see Integrate Azure Data Explorer for long-term log retention.

Use data collection rules for your Windows Security Events

The Windows Security Events connector enables you to stream security events from any computer running Windows Server that's connected to your Microsoft Sentinel workspace, including physical, virtual, or on-premises servers, or in any cloud. This connector includes support for the Azure Monitor agent, which uses data collection rules to define the data to collect from each agent.

Data collection rules enable you to manage collection settings at scale, while still allowing unique, scoped configurations for subsets of machines. For more information, see Configure data collection for the Azure Monitor agent.

Besides for the predefined sets of events that you can select to ingest, such as All events, Minimal, or Common, data collection rules enable you to build custom filters and select specific events to ingest. The Azure Monitor Agent uses these rules to filter the data at the source, and then ingest only the events you've selected, while leaving everything else behind. Selecting specific events to ingest can help you optimize your costs and save more.

Next steps

Learn how to optimize your cloud investment with Azure Cost Management.
Learn more about managing costs with cost analysis.
Learn about how to prevent unexpected costs.
Take the Cost Management guided learning course.
For more tips on reducing Log Analytics data volume, see Azure Monitor best practices - Cost management.

Reduce costs for Microsoft Sentinel (2024)

FAQs

Why is Microsoft Sentinel so expensive? ›

Pricing is based on the types of logs ingested into a workspace. Analytics logs typically make up most of your high value security logs. Basic logs tend to be verbose with low security value. It's important to note that billing is done per workspace on a daily basis for all log types and tiers.

Read On ›

What problems is Microsoft Sentinel solving and how is that benefiting you? ›

Microsoft Sentinel has several benefits, including ease of use, seamless integration with Microsoft products, robust Azure infrastructure, machine learning for proactive threat detection, and more. To ensure a smooth transition, plan in phases (discovery, design, implementation) and prioritize valuable detection rules.

Discover More Details ›

What are the free data sources for Microsoft Sentinel? ›

"The following data sources are free with Microsoft Sentinel: Azure Activity Logs. Office 365 Audit Logs, including all SharePoint activity, Exchange admin activity, and Teams.

How do you reduce sentinel activity? ›

Sentinels can now be temporarily disabled, either by defeating the final wave of Sentinel forces in a battle, or by locating and interfacing with a planetary Sentinel Pillar.

See Details ›

How can we reduce the cost of security? ›

Having a well-prepared incident response plan is a game-changer. It ensures you know what to do if things go awry. Such plans help you respond quickly to security incidents, minimizing their impact and the associated costs. Regular security audits act like health checkups for your data security.

Find Out More ›

Why is Splunk better than Sentinel? ›

With Splunk, you get automatic security content updates delivered directly from the Splunk Threat Research Team to help you stay on top of new and emerging threats. Microsoft Sentinel makes it difficult to identify key, impactful content when you're outside of the console.

Tell Me More ›

What is the difference between Microsoft Sentinel and Azure Sentinel? ›

This blog will use both Microsoft Sentinel and Azure Sentinel, but for the sake of clarity, both terms refer to the same product. Azure Sentinel is a cloud-based security information and event management (SIEM) solution that helps you detect, investigate, and respond to threats across your entire organization.

Show Me More ›

Is Microsoft Sentinel a SIEM or SOAR? ›

Microsoft Sentinel is a cloud-native security information and event management (SIEM) platform that uses built-in AI to help analyze large volumes of data across an enterprise—fast.

Explore More ›

What do you dislike about Microsoft Sentinel? ›

What do you dislike about Microsoft Sentinel? It integrates well with other microsoft products but users find challenges when they have to integrate with non-microsoft products. Users with non technical background finds it difficult to use Microsoft Sentinel.

Why choose Microsoft Sentinel? ›

Limitless cloud speed and scale

Start using Microsoft Sentinel immediately, automatically scale to meet your organizational needs, and pay for only the resources you need. As a cloud-native SIEM, Microsoft Sentinel is 48 percent less expensive and 67 percent faster to deploy than legacy on-premises SIEMs.

Show Me More ›

What is the difference between Microsoft Defender and Sentinel? ›

Microsoft Defender also provides detailed threat intelligence. Azure Sentinel, on the other hand, is a cloud-native Security Information Event Management (SIEM) and Security Orchestration Automated Response (SOAR) solution.

Read The Full Story ›

What are the 4 primary capabilities of Microsoft Sentinel? ›

It provides threat intelligence and intelligent security analytic capabilities that facilitate threat visibility, alert detection, threat response, and proactive hunting.

See Details ›

What license do I need for Microsoft Sentinel? ›

For Sentinel to be able to get the Sign-In logs you will need to Assign P1 or P2 license per user.

Get More Info Here ›

How does Microsoft Sentinel collect data? ›

Microsoft Sentinel can use agents provided by the Azure Monitor service (on which Microsoft Sentinel is based) to collect data from any data source that can perform real-time log streaming. For example, most on-premises data sources connect by using agent-based integration.

How can I reduce my GCP cost? ›

5 quick tips to reduce your Google Cloud Costs

Remove unattached block-level storage discs. ...
Get rid of IP addresses not in use. ...
Schedule non-production virtual machines. ...
Make the best use of Committed Use Discounts (CUDs) ...
Utilize low cost storage to store less-frequently used data.

Oct 17, 2022

How do you deal with a sentinel? ›

If a player provokes a Sentinel on a planet, the usual way to disengage from combat is to flee and avoid detection by Drones until they give up the search. As of the Sentinel update, Sentinels should still detect you inside caves and buildings, although it is still difficult for them to follow you in narrow spaces.

View Details ›

What is sentinel solution for Dynamics 365? ›

The solution monitors and protects your Dynamics 365 Finance and Operations system: It collects audits and activity logs from the Dynamics 365 Finance and Operations environment, and detects threats, suspicious activities, illegitimate activities, and more.