Navigating the costs associated with Microsoft Sentinel can be a complex task, but with the right strategies, you can significantly reduce your expenses. In this comprehensive guide, we’ll explore various methods to optimize your Microsoft Sentinel costs and ensure you get the most value from your investment.

Set or Change Pricing Tier

To achieve the highest savings, closely monitor your data ingestion volume and ensure you have the Commitment Tier that aligns most closely with your usage patterns. Regularly review and adjust your Commitment Tier as your data volumes change to maintain cost efficiency.

You can increase your Commitment Tier at any time, which will restart the 31-day commitment period. However, to move back to Pay-As-You-Go or a lower Commitment Tier, you’ll need to wait until the end of the 31-day commitment period. Billing for Commitment Tiers is on a daily basis.

To view your current Microsoft Sentinel pricing tier, navigate to the Settings menu in the Microsoft Sentinel portal, then select the Pricing tab. Your current pricing tier will be marked as the Current tier.

If you need to change your pricing tier commitment, simply select one of the other tiers on the pricing page and click Apply. Keep in mind that you’ll need Contributor or Owner permissions for the Microsoft Sentinel workspace to make these changes.

Separate Non-Security Data into a Different Workspace

Microsoft Sentinel analyzes all the data ingested into its enabled Log Analytics workspaces. To avoid incurring additional costs for non-security operational data, it’s best to have a separate workspace dedicated to this type of information.

When investigating threats in Microsoft Sentinel, you may need to access the operational data stored in these standalone Azure Log Analytics workspaces. You can do this by using cross-workspace querying in the log exploration experience and workbooks. However, you won’t be able to use cross-workspace analytics rules and hunting queries unless Microsoft Sentinel is enabled on all the workspaces.

Enable Basic Logs Data Ingestion for High-Volume, Low-Security Value Data (Preview)

Unlike analytics logs, basic logs are typically more verbose and contain a mix of high-volume and low-security value data. This type of data isn’t frequently used or accessed for ad-hoc querying, investigations, and searches.

To reduce costs, you can enable basic log data ingestion at a significantly lower rate for eligible data tables. For more information, refer to the Microsoft Sentinel Pricing page.

Optimize Log Analytics Costs with Dedicated Clusters

If you ingest at least 500 GB into your Microsoft Sentinel workspace or workspaces in the same region, consider moving to a Log Analytics dedicated cluster to decrease costs. A Log Analytics dedicated cluster Commitment Tier aggregates data volume across workspaces that collectively ingest a total of 500 GB or more. For more details, see the Simplified pricing tier for dedicated cluster documentation.

Using a Log Analytics dedicated cluster for Microsoft Sentinel offers a few advantages:

  • Cross-workspace queries run faster when all the workspaces involved are in the dedicated cluster. It’s still best to have as few workspaces as possible in your environment, and a dedicated cluster still retains the 100 workspace limit for inclusion in a single cross-workspace query.
  • All workspaces in the dedicated cluster can share the Log Analytics Commitment Tier set on the cluster, allowing for cost savings and efficiencies. By enabling a dedicated cluster, you commit to a minimum Log Analytics Commitment Tier of 500 GB ingestion per day.

Reduce Long-Term Data Retention Costs with Azure Data Explorer or Archived Logs (Preview)

Microsoft Sentinel data retention is free for the first 90 days. To adjust the data retention period in Log Analytics, navigate to the Usage and estimated costs section, select Data retention, and then adjust the slider.

After a few months, some of the security value in Microsoft Sentinel data may diminish. Security operations center (SOC) users may not need to access older data as frequently as newer data, but they may still require access for sporadic investigations or audit purposes.

To help reduce Microsoft Sentinel data retention costs, Azure Monitor now offers archived logs. Archived logs store log data for up to seven years at a reduced cost, but with some usage limitations. Archived logs are currently in public preview. For more information, see the Configure data retention and archive policies in Azure Monitor Logs documentation.

Alternatively, you can use Azure Data Explorer for long-term data retention at a lower cost. Azure Data Explorer provides a balance of cost and usability for aged data that no longer requires Microsoft Sentinel’s security intelligence. You can store data at a lower price while still exploring it using the same Kusto Query Language (KQL) queries as in Microsoft Sentinel. The Azure Data Explorer proxy feature also allows you to perform cross-platform queries that aggregate and correlate data across Azure Data Explorer, Application Insights, Microsoft Sentinel, and Log Analytics.

For more details, refer to the Integrate Azure Data Explorer for long-term log retention documentation.

Use Data Collection Rules for Your Windows Security Events

The Windows Security Events connector enables you to stream security events from any Windows Server computer connected to your Microsoft Sentinel workspace, including physical, virtual, on-premises, or cloud-based servers. This connector supports the Azure Monitor agent, which uses data collection rules to define the data to collect from each agent.

Data collection rules allow you to manage collection settings at scale, while still providing unique, scoped configurations for subsets of machines. For more information, see the Configure data collection for the Azure Monitor agent documentation.

In addition to the predefined event sets you can select for ingestion (such as All events, Minimal, or Common), data collection rules allow you to build custom filters and select specific events to ingest. The Azure Monitor Agent uses these rules to filter the data at the source, ingesting only the events you’ve selected and leaving the rest behind. Carefully selecting the events to ingest can help you optimize your costs and save more.

Next Steps

By implementing these strategies, you can significantly optimize your Microsoft Sentinel costs and ensure your security investments align with your business needs. Stay vigilant and continue exploring ways to enhance your cost efficiency while maintaining the robust security capabilities that Microsoft Sentinel provides.

Source: Reduce costs for Microsoft Sentinel