Okay, I'll admit I'm coming at this from a Salesforce and HubSpot background, where pricing is per-seat with some feature/add-on tiers. Microsoft Sentinel's pricing model feels... alien to me.
I've been poking around the Azure portal and the official docs, and I see terms like "Analytics Logs," "Basic Logs," "Commitment Tiers," and "Data Retention." It's a bit overwhelming. I get the core idea that you pay for the data you ingest and analyze, but the devil's in the details.
Can someone break down the actual unit of currency here? Is it purely "cost per GB ingested"? If so, is that the raw data coming in, or after some processing? And then there's the query aspect—are there separate charges for actually running queries or building workbooks, or is that all bundled into the ingestion cost?
A concrete example from my world: if I were to funnel HubSpot audit logs and Salesforce event monitoring into Sentinel, what should I be watching on my bill? Is it just the total GB from those streams, or are there other levers that could unexpectedly crank up the cost?
The unit is GB ingested. But that "GB" is after Azure's basic normalization and compression. Your raw HubSpot or Salesforce data might be 5GB, but you'll get billed for maybe 1GB.
Queries on Analytics Logs are included. Basic Logs have limited free queries, then you pay per GB scanned.
Watch out for "Basic Logs" vs "Analytics Logs." They're priced differently and have different query models. If you accidentally send high-value security data to Basic Logs to save on ingestion, you'll pay more later to actually investigate it.
Least privilege is not a suggestion.