{ "version": "Notebook/1.0", "items": [ { "type": 1, "content": { "json": "# Microsoft Sentinel Cost Summary (GBP)\n---\n" }, "name": "text - 2" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "4f3a930b-1a32-4892-b26c-6077e404a741", "version": "KqlParameterItem/1.0", "name": "DefaultSubscription_Internal", "type": 1, "isRequired": true, "query": "where type =~ 'microsoft.operationalinsights/workspaces'\r\n| take 1\r\n| project subscriptionId", "crossComponentResources": [ "value::selected" ], "isHiddenWhenLocked": true, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources" }, { "id": "1ca69445-60fc-4806-b43d-ac7e6aad630a", "version": "KqlParameterItem/1.0", "name": "Subscription", "type": 6, "query": "summarize by subscriptionId\r\n| project value = strcat(\"/subscriptions/\", subscriptionId), label = subscriptionId, selected = iff(subscriptionId =~ '{DefaultSubscription_Internal}', true, false)\r\n", "crossComponentResources": [ "value::selected" ], "typeSettings": { "additionalResourceOptions": [], "showDefault": false }, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "label": "☁️ Subscription" }, { "id": "e94aafa3-c5d9-4523-89f0-4e87aa754511", "version": "KqlParameterItem/1.0", "name": "Workspace", "label": "πŸ—‚οΈ Workspace", "type": 5, "isRequired": true, "query": "resources\n| where type =~ 'microsoft.operationalinsights/workspaces' \n//| where subscriptionId == '{Subscription:id}'\n| project id", "crossComponentResources": [ "{Subscription}" ], "value": "", "typeSettings": { "resourceTypeFilter": { "microsoft.operationalinsights/workspaces": true }, "additionalResourceOptions": [] }, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources" }, { "id": "c4b69c01-2263-4ada-8d9c-43433b739ff3", "version": "KqlParameterItem/1.0", "name": "TimeRange", "type": 4, "value": { "durationMs": 2592000000 }, "typeSettings": { "selectableValues": [ { "durationMs": 300000 }, { "durationMs": 900000 }, { "durationMs": 1800000 }, { "durationMs": 3600000 }, { "durationMs": 14400000 }, { "durationMs": 43200000 }, { "durationMs": 86400000 }, { "durationMs": 172800000 }, { "durationMs": 259200000 }, { "durationMs": 604800000 }, { "durationMs": 1209600000 }, { "durationMs": 2419200000 }, { "durationMs": 2592000000 }, { "durationMs": 5184000000 }, { "durationMs": 7776000000 } ], "allowCustom": true }, "label": "⏱️ Time Range" }, { "id": "79bbec8c-8253-41b5-83ce-6e48d5c43101", "version": "KqlParameterItem/1.0", "name": "SentinelPrice", "label": "Sentinel Price", "type": 1, "description": "Enter a value for Sentinel Data cost, default: 4.38", "value": "4.38" }, { "id": "e55ac850-a330-44cf-81ba-c3343847e1cc", "version": "KqlParameterItem/1.0", "name": "CommitmentTierPrice", "label": "Commitment Tier Price", "type": 1, "value": "2.38" }, { "id": "b2ff75b5-dc13-4fb9-b15f-1886093e514c", "version": "KqlParameterItem/1.0", "name": "Price", "label": "Ingestion Price", "type": 1, "description": "Enter your ingestion price per GB (PAYG or Commitment Tier). You can also refer to Azure Pricing Calculator.", "value": "0.10" }, { "id": "13579241-5d44-42aa-94a1-789a9c9636f3", "version": "KqlParameterItem/1.0", "name": "TotalE5Seats", "label": "Total seats (E5/A5/F5/G5)", "type": 1, "description": "Enter the total number of Microsoft 365 E5, A5, F5, G5 and Microsoft 365 E5, A5, F5, G5 Security licenses in your environment", "value": "3000" }, { "id": "5b009c23-b8f9-4930-bff8-7849e911bfab", "version": "KqlParameterItem/1.0", "name": "retentionDays", "label": "How many days retention are required? Defaults to current setting", "type": 1, "query": "resources\r\n| where type =~ 'microsoft.operationalinsights/workspaces' \r\n| where id has \"{Workspace}\"\r\n| extend retentionDays = trim(' ', tostring(properties.retentionInDays))\r\n| project retentionDays", "crossComponentResources": [ "value::selected" ], "queryType": 1, "resourceType": "microsoft.resourcegraph/resources" }, { "id": "1ac7a923-ac85-444d-ae62-b4a473728849", "version": "KqlParameterItem/1.0", "name": "Retention", "label": "Retention price per GB", "type": 1, "description": "Obtain a value from the Azure Pricing Calculator, default: 0.10", "value": "0.10" }, { "id": "eafaa0ec-7c3a-4ee5-babe-9850080c909d", "version": "KqlParameterItem/1.0", "name": "resourceGroup", "type": 1, "query": "resources\r\n| where type =~ 'microsoft.operationalinsights/workspaces'\r\n| where id == \"{Workspace}\"\r\n| project resourceGroup", "crossComponentResources": [ "value::selected" ], "isHiddenWhenLocked": true, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources" }, { "id": "27308a9d-46a2-4fca-8035-e813201fb4f8", "version": "KqlParameterItem/1.0", "name": "GBperday", "type": 1, "description": "Shows Average per Day over selected Duration (GB)", "query": "Usage\r\n| where TimeGenerated > startofday({TimeRange:start}) and TimeGenerated < startofday({TimeRange:end})\r\n// Only look at chargeable Tables\r\n| where IsBillable == True\r\n| summarize\r\nTotalBytes =round(sum(Quantity))\r\nby bin(TimeGenerated, 1d)\r\n| summarize GBperday = round(avg(TotalBytes)/1000,2)\r\n", "crossComponentResources": [ "{Workspace}" ], "isHiddenWhenLocked": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, { "id": "bd9b6f2d-3e7b-4d2c-83b4-f77154f6af42", "version": "KqlParameterItem/1.0", "name": "GBtotal", "type": 1, "query": "Usage\r\n| where StartTime {TimeRange:value}\r\n| where IsBillable == True\r\n| parse ResourceUri with *'/subscriptions/' SubscriptionId '/resourcegroups/'*\r\n| where SubscriptionId == '{Subscription:id}'\r\n| summarize Gbytes = sum(Quantity)/1000 by SubscriptionId\r\n| project TotalGBytes = round(Gbytes,2)", "crossComponentResources": [ "{Workspace}" ], "isHiddenWhenLocked": true, "timeContext": { "durationMs": 2592000000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, { "id": "f4e5f464-d682-4969-a7b3-56144f30d3d3", "version": "KqlParameterItem/1.0", "name": "SentinelCap", "type": 1, "query": "resources\r\n| where type =~ 'microsoft.operationalinsights/workspaces' \r\n| where id has \"{Workspace}\"\r\n| extend sku = tolower(properties.sku.name)\r\n| extend capacityReservationLevel = properties.sku.capacityReservationLevel\r\n// add fake level for testing\r\n//| extend capacityReservationLevel = 200 , sku = \"capacityreservation\"\r\n//\r\n| project capacityReservationLevel", "crossComponentResources": [ "{Subscription}" ], "isHiddenWhenLocked": true, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources" }, { "id": "03f2c786-6e51-4692-b967-0d8fa632e209", "version": "KqlParameterItem/1.0", "name": "discountRate", "type": 1, "query": "resources\r\n| where type =~ 'microsoft.operationalinsights/workspaces' \r\n| where id has \"{Workspace}\"\r\n| extend sku = tolower(properties.sku.name)\r\n| extend capacityReservationLevel = properties.sku.capacityReservationLevel\r\n// add fake level for testing\r\n//| extend capacityReservationLevel = 2000 , sku = \"capacityreservation\"\r\n| extend discountRate = case(\r\ncapacityReservationLevel == 100,50,\r\ncapacityReservationLevel == 200,55,\r\ncapacityReservationLevel == 300,57,\r\ncapacityReservationLevel == 400,58,\r\ncapacityReservationLevel == 500,60,\r\ncapacityReservationLevel == 1000,61,\r\ncapacityReservationLevel == 2000,63,\r\ncapacityReservationLevel >= 5000,65,\r\n// else\r\n0\r\n)\r\n| project discountRate\r\n\r\n", "crossComponentResources": [ "{Subscription}" ], "isHiddenWhenLocked": true, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "value": "50" }, { "id": "ae34080a-d959-484b-99a4-14c3ed730bf1", "version": "KqlParameterItem/1.0", "name": "lawCap", "type": 1, "query": "resources\r\n| where type =~ 'microsoft.operationalinsights/workspaces' \r\n| where id has \"{Workspace}\"\r\n| project capacityReservationLevel = properties.sku.capacityReservationLevel", "crossComponentResources": [ "{Subscription}" ], "isHiddenWhenLocked": true, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources" }, { "id": "71516fe6-3e08-4bb1-bfd8-0dda6852b03a", "version": "KqlParameterItem/1.0", "name": "SentinelSku", "type": 1, "query": "resources\r\n| where type =~ 'microsoft.operationalinsights/workspaces' \r\n| where id has \"{Workspace}\"\r\n| project sku = tolower(properties.sku.name)", "crossComponentResources": [ "{Subscription}" ], "isHiddenWhenLocked": true, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources" } ], "style": "above", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 1" }, { "type": 1, "content": { "json": "
" }, "name": "text - 7" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "tabs", "links": [ { "id": "4df9243a-749d-4698-98f6-188e0b687e13", "cellValue": "selectedTab", "linkTarget": "parameter", "linkLabel": "πŸ” Microsoft Sentinel", "subTarget": "Sentinel", "style": "link" }, { "id": "ffceb6e6-3756-466e-860b-c017f0421e9f", "cellValue": "selectedTab", "linkTarget": "parameter", "linkLabel": "πŸ’° Microsoft Sentinel Benefits", "subTarget": "Benefits", "style": "link" }, { "id": "f43799bc-9001-428d-a18b-b8be2df27a5e", "cellValue": "selectedTab", "linkTarget": "parameter", "linkLabel": " 🦾 SOAR Cost", "subTarget": "SOAR", "style": "link" }, { "id": "25b0dfdf-9de1-4a16-b66f-c5b3822c8018", "cellValue": "selectedTab", "linkTarget": "parameter", "linkLabel": "πŸ”’ Commitment Tier", "subTarget": "Commitment", "style": "link" } ] }, "name": "links - 19" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "## Ingestion summary" }, "name": "text - 2" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "union withsource=TableName1 * | where TimeGenerated < ago(90d) | extend key = 'Key' | summarize size = sum(_BilledSize)/1024/1024/1024 by key\r\n| project ['Data over 90 days'] = size, ['Retention Cost'] = size*{Retention}\r\n", "size": 4, "title": "Data older than 90 days and resulting retention cost", "noDataMessage": "You have no data older than 90 days", "noDataMessageStyle": 3, "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "33", "name": "query - 0" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "union withsource = tt *\r\n| where TimeGenerated > startofday({TimeRange:start}) and TimeGenerated < startofday({TimeRange:end})\r\n// Only look at chargeable Tables\r\n| where _IsBillable == True\r\n| summarize TotalGBytes =round(sum(_BilledSize/(1024*1024*1024)),2) by bin(TimeGenerated, 1d)//, Solution=tt\r\n| summarize ['GBs/day'] =round(avg(TotalGBytes),2)", "size": 4, "title": "Average billable GBs/day ingested in the last {TimeRange}", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "tiles", "tileSettings": { "titleContent": { "columnMatch": "GBs/day", "formatter": 12, "formatOptions": { "palette": "greenRed" } }, "showBorder": false, "size": "auto" } }, "customWidth": "33", "name": "query - 6" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Usage\r\n| where IsBillable == true\r\n| summarize size = sum(Quantity)/1024 by IsBillable\r\n| project ['Total data ingestion'] = size, ['Estimated cost'] = size*{SentinelPrice}", "size": 4, "title": "Total billable ingestion and cost in the last {TimeRange}", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "tiles", "tileSettings": { "titleContent": { "formatter": 12, "formatOptions": { "palette": "greenRed", "compositeBarSettings": { "labelText": "", "columnSettings": [] } }, "numberFormat": { "unit": 0, "options": { "currency": "USD", "style": "currency", "useGrouping": false } } }, "leftContent": { "columnMatch": "Total data ingestion", "formatter": 12, "formatOptions": { "palette": "greenRed" }, "numberFormat": { "unit": 39, "options": { "style": "decimal", "useGrouping": false, "maximumFractionDigits": 1 } } }, "rightContent": { "columnMatch": "Estimated cost", "formatter": 12, "formatOptions": { "palette": "greenRed" }, "numberFormat": { "unit": 0, "options": { "currency": "GBP", "style": "currency", "useGrouping": false, "maximumFractionDigits": 1 } } }, "showBorder": false, "size": "auto" } }, "customWidth": "33", "name": "query - 8" } ] }, "name": "group - 20" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let Categories = datatable(Type:string,Category:string)\r\n[\r\n\"AuditLogs\" , \"Azure Active Directory\",\r\n\"SigninLogs\" , \"Azure Active Directory\",\r\n\"AADNonInteractiveUserSignInLogs\" , \"Azure Active Directory\",\r\n\"AADRiskyUsers\" , \"Azure Active Directory\",\r\n\"AADRiskyServicePrincipals\" , \"Azure Active Directory\",\r\n\"AADServicePrincipalRiskEvents\" , \"Azure Active Directory\",\r\n\"ADFSSignInLogs\" , \"Azure Active Directory\",\r\n\"NetworkAccessTraffic\" , \"Azure Active Directory\",\r\n\"AADUserRiskEvents\" , \"Azure Active Directory\",\r\n\"AADServicePrincipalSignInLogs\" , \"Azure Active Directory\",\r\n\"AADManagedIdentitySignInLogs\" , \"Azure Active Directory\",\r\n\"AADProvisioningLogs\" , \"Azure Active Directory\",\r\n\"AZFWApplicationRule\" , \"Firewall\",\r\n\"AZFWApplicationRuleAggregation\" , \"Firewall\",\r\n\"AZFWDnsQuery\" , \"Firewall\",\r\n\"AZFWIdpsSignature\" , \"Firewall\",\r\n\"AZFWNatRule\" , \"Firewall\",\r\n\"AZFWNatRuleAggregation\" , \"Firewall\",\r\n\"AZFWNetworkRule\" , \"Firewall\",\r\n\"AZFWNetworkRuleAggregation\" , \"Firewall\",\r\n\"WindowsFirewall\" , \"Firewall\",\r\n\"Event\" , \"Custom Events\",\r\n\"BehaviorAnalytics\" , \"User Entity Behavior Analytics\",\r\n\"UserPeerAnalytics\" , \"User Entity Behavior Analytics\",\r\n\"UserAccessAnalytics\" , \"User Entity Behavior Analytics\",\r\n\"IdentityInfo\" , \"User Entity Behavior Analytics\",\r\n\"DeviceLogonEvents\" , \"Microsoft Defender for Endpoint\",\r\n\"DeviceEvents\" , \"Microsoft Defender for Endpoint\",\r\n\"DeviceNetworkInfo\" , \"Microsoft Defender for Endpoint\",\r\n\"DeviceImageLoadEvents\" , \"Microsoft Defender for Endpoint\",\r\n\"DeviceFileEvents\" , \"Microsoft Defender for Endpoint\",\r\n\"DeviceInfo\" , \"Microsoft Defender for Endpoint\",\r\n\"DeviceProcessEvents\" , \"Microsoft Defender for Endpoint\",\r\n\"DeviceNetworkEvents\" , \"Microsoft Defender for Endpoint\",\r\n\"DeviceRegistryEvents\" , \"Microsoft Defender for Endpoint\",\r\n\"DeviceFileCertificateInfo\" , \"Microsoft Defender for Endpoint\",\r\n\"EmailAttachmentInfo\" , \"Microsoft Defender for Office 365\",\r\n\"EmailEvents\" , \"Microsoft Defender for Office 365\",\r\n\"EmailPostDeliveryEvents\" , \"Microsoft Defender for Office 365\",\r\n\"EmailUrlInfo\" , \"Microsoft Defender for Office 365\",\r\n\"IdentityLogonEvents\" , \"Microsoft Defender for Identity\",\r\n\"IdentityQueryEvents\" , \"Microsoft Defender for Identity\",\r\n\"IdentityDirectoryEvents\" , \"Microsoft Defender for Identity\",\r\n\"CloudAppEvents\" , \"Microsoft Defender for Cloud Apps\",\r\n\"AlertEvidence\" , \"Microsoft Defender Alert Evidence\",\r\n\"InsightsMetrics\" , \"Azure Monitor for VMs\",\r\n\"VMBoundPort\" , \"Azure Monitor for VMs\",\r\n\"VMComputer\" , \"Azure Monitor for VMs\",\r\n\"VMConnection\" , \"Azure Monitor for VMs\",\r\n\"VMProcess\" , \"Azure Monitor for VMs\",\r\n\"SecurityEvent\" , \"Windows Security Events\",\r\n\"StorageBlobLogs\" , \"Azure Storage\",\r\n\"StorageFileLogs\" , \"Azure Storage\",\r\n\"Syslog\" , \"Syslog/CEF\",\r\n\"SecurityIoTRawEvent\" , \"IoT Logs\",\r\n\"CommonSecurityLog\" , \"Syslog/CEF\",\r\n\"ThreatIntelligenceIndicator\" , \"Sentinel\",\r\n\"DnsEvents\" , \"DNS Logs\",\r\n\"DnsInventory\" , \"DNS Logs\",\r\n\"AWSCloudTrail\" , \"AWS Logs\",\r\n\"AWSVPCFlow\" , \"AWS Logs\",\r\n\"ConfigurationChange\" , \"Change Tracking\",\r\n\"ConfigurationData\" , \"Change Tracking\",\r\n\"AzureDiagnostics\" , \"Azure Resources\",\r\n\"AzureActivity\" , \"Azure Resources\",\r\n\"LAQueryLogs\" , \"Management\",\r\n\"SentinelHealth\" , \"Sentinel\",\r\n\"Perf\" , \"Performance\",\r\n\"AzureMetrics\" , \"Azure Metrics\",\r\n\"SecurityNestedRecommendation\" , \"Microsoft Defender for Cloud\",\r\n\"SecurityRecommendation\" , \"Microsoft Defender for Cloud\",\r\n\"SecurityRegulatoryCompliance\" , \"Microsoft Defender for Cloud\",\r\n\"SecureScoreControls\" , \"Microsoft Defender for Cloud\",\r\n\"SecurityBaseline\" , \"Microsoft Defender for Cloud\",\r\n\"SecureScores\" , \"Microsoft Defender for Cloud\",\r\n\"Update\" , \"Update Management\",\r\n\"UpdateSummary\" , \"Update Management\",\r\n\"DeviceTvmSecureConfigurationAssessment\" , \"Microsoft Defender Vuln. Management\",\r\n\"DeviceTvmSoftwareVulnerabilities\" , \"Microsoft Defender Vuln. Management\",\r\n\"DeviceTvmSoftwareInventory\" , \"Microsoft Defender Vuln. Management\",\r\n\"UrlClickEvents\" , \"Microsoft Defender for Office 365\",\r\n\"SecurityBaselineSummary\" , \"Microsoft Defender for Cloud\",\r\n\"AZFWThreatIntel\" , \"Firewall\",\r\n\"AWSGuardDuty\" , \"AWS Logs\",\r\n\"Watchlist\" , \"Sentinel\",\r\n\"HuntingBookmark\" , \"Sentinel\",\r\n\"SentinelAudit\" , \"Sentinel\",\r\n\"Operation\" , \"Log Management\",\r\n\"StorageTableLogs\" , \"Azure Storage\",\r\n\"AddonAzureBackupStorage\" , \"Azure Storage\",\r\n\"AddonAzureBackupPolicy\" , \"Azure Storage\",\r\n\"StorageQueueLogs\" , \"Azure Storage\",\r\n\"AddonAzureBackupProtectedInstance\" , \"Azure Storage\",\r\n\"AddonAzureBackupJobs\" , \"Azure Storage\"\r\n];\r\nlet customTables = Usage\r\n| where IsBillable == true\r\n| where DataType contains \"_CL\"\r\n| summarize size = sum(Quantity)/1024 by DataType\r\n| project ['Log Type'] = \"Custom Log\",['Table'] = DataType, ['Table Size'] = size, ['Estimated cost'] = size*4.3;\r\nlet AzDiagTables = AzureDiagnostics\r\n| summarize TotalIngestBytes=sum(_BilledSize) by Category\r\n| project ['Log Type'] = \"AzureDiagnostics\", ['Table'] = Category ,['Table Size'] = TotalIngestBytes/1024000000 , ['Estimated cost'] = (TotalIngestBytes/1024000000 ) * 4.3;\r\nlet knownTables = Usage\r\n| where IsBillable == true \r\n| where DataType <> \"AzureDiagnostics\"\r\n| join kind=leftouter Categories on $left.DataType == $right.Type\r\n| summarize size =sumif(Quantity, isnotempty(Category))/1024, sizeOther= sumif(Quantity,(isempty(Category) and DataType !contains \"_CL\"))/1024 by Category, DataType\r\n| project ['Log Type'] = iif(isnotempty( Category),Category,\"Other\"), ['Table'] = DataType, ['Table Size'] = iif(isnotempty( Category),size,sizeOther), ['Estimated cost'] = iif(isnotempty(Category),size*4.3,sizeOther*4.3);\r\nunion customTables, knownTables, AzDiagTables\r\n| sort by ['Estimated cost'] desc", "size": 0, "title": "Breakdown of billable ingestion by log category in the last {TimeRange}", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Group", "formatter": 1 }, { "columnMatch": "Table Size", "formatter": 3, "formatOptions": { "palette": "greenRed" }, "numberFormat": { "unit": 39, "options": { "style": "decimal", "useGrouping": false } } }, { "columnMatch": "Estimated cost", "formatter": 0, "numberFormat": { "unit": 0, "options": { "currency": "GBP", "style": "currency" } } } ], "hierarchySettings": { "treeType": 1, "groupBy": [ "Log Type" ], "finalBy": "Table" } }, "graphSettings": { "type": 0, "topContent": { "columnMatch": "Log Category", "formatter": 1 }, "centerContent": { "columnMatch": "Billed Size", "formatter": 1, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } } }, "name": "query - 2" } ] }, "conditionalVisibility": { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "Sentinel" }, "name": "group - Microsoft Sentinel" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "## Microsoft Sentinel benefit for Microsoft 365 E5, A5, F5 and G5 customers\r\n\r\nWith security information and event management (SIEM) and extended detection and response (XDR) from Microsoft, you’re armed with the context and automation you need to stop sophisticated, cross-domain attacks across your entire organization. \r\n\r\nMicrosoft 365 E5, A5, F5, G5 and Microsoft 365 E5, A5, F5, G5 Security customers can get data grant up to 5MB per user/day of Microsoft 365 data ingestion into Microsoft Sentinel.
\r\nThe data sources included in this offer include:\r\n\r\n- Microsoft Entra ID (Azure AD) sign-in and audit logs\r\n- Microsoft Cloud App Security shadow IT discovery logs\r\n- Microsoft Information Protection logs\r\n- Microsoft 365 advanced hunting data\r\n\r\nThe data grant will be calculated at the end of the month and applied to your bill, covering the cost of up to 5 MB of data ingestion per user/day.\r\n\r\nVisit https://azure.microsoft.com/offers/sentinel-microsoft-365-offer/ for more information\r\n\r\n
\r\n\r\n### Below are the ingestion for the eligible data sources:\r\n\r\n_**Note:** Kindly specify **Total seats (E5/A5/F5/G5)** and **Ingestion Price** parameters for calculation._" }, "name": "text - 12" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Usage\r\n| where IsBillable == true\r\n| where DataType in (\"SigninLogs\", \r\n\"AuditLogs\", \r\n\"AADNonInteractiveUserSignInLogs\", \r\n\"AADServicePrincipalSignInLogs\",\r\n\"AADManagedIdentitySignInLogs\",\r\n\"AADProvisioningLogs\",\r\n\"ADFSSignInLogs\",\r\n\"McasShadowItReporting\", \r\n\"InformationProtectionLogs_CL\", \r\n\"DeviceEvents\",β€― \r\n\"DeviceFileEvents\",β€― \r\n\"DeviceImageLoadEvents\",β€― \r\n\"DeviceInfo\",β€― \r\n\"DeviceLogonEvents\",β€― \r\n\"DeviceNetworkEvents\",β€― \r\n\"DeviceNetworkInfo\",β€― \r\n\"DeviceProcessEvents\",β€― \r\n\"DeviceRegistryEvents\",\r\n\"DeviceFileCertificateInfo\",β€― \r\n\"EmailAttachmentInfo\",β€― \r\n\"EmailEvents\",β€― \r\n\"EmailPostDeliveryEvents\",β€― \r\n\"EmailUrlInfo\",\r\n\"IdentityLogonEvents\",\r\n\"IdentityQueryEvents\",\r\n\"IdentityDirectoryEvents\",\r\n\"AlertEvidence\",\r\n\"CloudAppEvents\"\r\n) β€― \r\n| summarize BillableDataGB = sum(Quantity) / 1000. by DataType\r\n| order by BillableDataGB desc\r\n", "size": 0, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "BillableDataGB", "formatter": 3, "formatOptions": { "palette": "blue" } } ] } }, "name": "query - 13" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Usage\r\n| where IsBillable == true\r\n| where DataType in (\"SigninLogs\", \r\n\"AuditLogs\", \r\n\"AADNonInteractiveUserSignInLogs\", \r\n\"AADServicePrincipalSignInLogs\",\r\n\"AADManagedIdentitySignInLogs\",\r\n\"AADProvisioningLogs\",\r\n\"ADFSSignInLogs\",\r\n\"McasShadowItReporting\", \r\n\"InformationProtectionLogs_CL\", \r\n\"DeviceEvents\",β€― \r\n\"DeviceFileEvents\",β€― \r\n\"DeviceImageLoadEvents\",β€― \r\n\"DeviceInfo\",β€― \r\n\"DeviceLogonEvents\",β€― \r\n\"DeviceNetworkEvents\",β€― \r\n\"DeviceNetworkInfo\",β€― \r\n\"DeviceProcessEvents\",β€― \r\n\"DeviceRegistryEvents\",\r\n\"DeviceFileCertificateInfo\",β€― \r\n\"EmailAttachmentInfo\",β€― \r\n\"EmailEvents\",β€― \r\n\"EmailPostDeliveryEvents\",β€― \r\n\"EmailUrlInfo\",\r\n\"IdentityLogonEvents\",\r\n\"IdentityQueryEvents\",\r\n\"IdentityDirectoryEvents\",\r\n\"AlertEvidence\",\r\n\"CloudAppEvents\") β€― \r\n| summarize DailyIngestionGB = toreal(sum(Quantity))/ 1024 by format_datetime(TimeGenerated, 'yyyy-MM-dd') \r\n| extend MaxDataGrantGB = ((5*toreal({TotalE5Seats}))/1024)\r\n| sort by TimeGenerated asc\r\n", "size": 0, "aggregation": 3, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "linechart", "chartSettings": { "xAxis": "TimeGenerated", "showDataPoints": true, "ySettings": { "numberFormatSettings": { "unit": 0, "options": { "style": "decimal", "useGrouping": true, "maximumFractionDigits": 3 } } } } }, "conditionalVisibilities": [ { "parameterName": "TotalE5Seats", "comparison": "isNotEqualTo" }, { "parameterName": "TotalE5Seats", "comparison": "isNotEqualTo", "value": "0" } ], "name": "DailyIngestionVSAllocation" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Usage\r\n| where IsBillable == true\r\n| where DataType in (\"SigninLogs\", \r\n\"AuditLogs\", \r\n\"AADNonInteractiveUserSignInLogs\", \r\n\"AADServicePrincipalSignInLogs\",\r\n\"AADManagedIdentitySignInLogs\",\r\n\"AADProvisioningLogs\",\r\n\"ADFSSignInLogs\",\r\n\"McasShadowItReporting\", \r\n\"InformationProtectionLogs_CL\", \r\n\"DeviceEvents\",β€― \r\n\"DeviceFileEvents\",β€― \r\n\"DeviceImageLoadEvents\",β€― \r\n\"DeviceInfo\",β€― \r\n\"DeviceLogonEvents\",β€― \r\n\"DeviceNetworkEvents\",β€― \r\n\"DeviceNetworkInfo\",β€― \r\n\"DeviceProcessEvents\",β€― \r\n\"DeviceRegistryEvents\",\r\n\"DeviceFileCertificateInfo\",β€― \r\n\"EmailAttachmentInfo\",β€― \r\n\"EmailEvents\",β€― \r\n\"EmailPostDeliveryEvents\",β€― \r\n\"EmailUrlInfo\",\r\n\"IdentityLogonEvents\",\r\n\"IdentityQueryEvents\",\r\n\"IdentityDirectoryEvents\",\r\n\"AlertEvidence\",\r\n\"CloudAppEvents\"\r\n) β€― \r\n| summarize TotalBillableDataGB = sum(Quantity) / 1024\r\n\r\n", "size": 4, "title": "Total ingestion", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "tiles", "tileSettings": { "titleContent": { "columnMatch": "TotalBillableDataGB", "formatter": 12, "formatOptions": { "palette": "greenRed" }, "numberFormat": { "unit": 39, "options": { "style": "decimal", "maximumFractionDigits": 2 } } }, "showBorder": false } }, "customWidth": "20", "name": "E5IngestionSize" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let DailyMaxDiscountGB = ((5*toreal({TotalE5Seats}))/1024);\r\nUsage\r\n| where IsBillable == true\r\n| where DataType in (\"SigninLogs\", \r\n\"AuditLogs\", \r\n\"AADNonInteractiveUserSignInLogs\", \r\n\"AADServicePrincipalSignInLogs\",\r\n\"AADManagedIdentitySignInLogs\",\r\n\"AADProvisioningLogs\",\r\n\"ADFSSignInLogs\",\r\n\"McasShadowItReporting\", \r\n\"InformationProtectionLogs_CL\", \r\n\"DeviceEvents\",β€― \r\n\"DeviceFileEvents\",β€― \r\n\"DeviceImageLoadEvents\",β€― \r\n\"DeviceInfo\",β€― \r\n\"DeviceLogonEvents\",β€― \r\n\"DeviceNetworkEvents\",β€― \r\n\"DeviceNetworkInfo\",β€― \r\n\"DeviceProcessEvents\",β€― \r\n\"DeviceRegistryEvents\",\r\n\"DeviceFileCertificateInfo\",β€― \r\n\"EmailAttachmentInfo\",β€― \r\n\"EmailEvents\",β€― \r\n\"EmailPostDeliveryEvents\",β€― \r\n\"EmailUrlInfo\",\r\n\"IdentityLogonEvents\",\r\n\"IdentityQueryEvents\",\r\n\"IdentityDirectoryEvents\",\r\n\"AlertEvidence\",\r\n\"CloudAppEvents\") β€― \r\n| summarize DailyBillableGB = toreal(sum(Quantity))/ 1024 by format_datetime(TimeGenerated, 'yy-MM-dd') \r\n| extend DailyMaxGrantGB = DailyMaxDiscountGB\r\n| summarize MaxDataGrantGB = sum(toreal(DailyMaxGrantGB))\r\n\r\n", "size": 4, "title": "Total Data Grant Limit", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "tiles", "tileSettings": { "titleContent": { "columnMatch": "MaxDataGrantGB", "formatter": 12, "formatOptions": { "palette": "orangeBlue" }, "numberFormat": { "unit": 39, "options": { "style": "decimal", "maximumFractionDigits": 2 } } }, "showBorder": false, "sortOrderField": 1 } }, "customWidth": "20", "conditionalVisibilities": [ { "parameterName": "TotalE5Seats", "comparison": "isNotEqualTo" }, { "parameterName": "TotalE5Seats", "comparison": "isNotEqualTo", "value": "0" } ], "name": "DataGrantLimit" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let DailyMaxDiscountGB = ((5*toreal({TotalE5Seats}))/1024);\r\nUsage\r\n| where IsBillable == true\r\n| where DataType in (\"SigninLogs\", \r\n\"AuditLogs\", \r\n\"AADNonInteractiveUserSignInLogs\", \r\n\"AADServicePrincipalSignInLogs\",\r\n\"AADManagedIdentitySignInLogs\",\r\n\"AADProvisioningLogs\",\r\n\"ADFSSignInLogs\",\r\n\"McasShadowItReporting\", \r\n\"InformationProtectionLogs_CL\", \r\n\"DeviceEvents\",β€― \r\n\"DeviceFileEvents\",β€― \r\n\"DeviceImageLoadEvents\",β€― \r\n\"DeviceInfo\",β€― \r\n\"DeviceLogonEvents\",β€― \r\n\"DeviceNetworkEvents\",β€― \r\n\"DeviceNetworkInfo\",β€― \r\n\"DeviceProcessEvents\",β€― \r\n\"DeviceRegistryEvents\",\r\n\"DeviceFileCertificateInfo\",β€― \r\n\"EmailAttachmentInfo\",β€― \r\n\"EmailEvents\",β€― \r\n\"EmailPostDeliveryEvents\",β€― \r\n\"EmailUrlInfo\",\r\n\"IdentityLogonEvents\",\r\n\"IdentityQueryEvents\",\r\n\"IdentityDirectoryEvents\",\r\n\"AlertEvidence\",\r\n\"CloudAppEvents\") β€― \r\n| summarize DailyBillableGB = toreal(sum(Quantity))/ 1024 by format_datetime(TimeGenerated, 'yy-MM-dd') \r\n| summarize TotalEligibleGB = sum(iif(toreal(DailyBillableGB)>toreal(DailyMaxDiscountGB),toreal(DailyMaxDiscountGB),DailyBillableGB))\r\n\r\n", "size": 4, "title": "Total Data Grant Used", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "tiles", "tileSettings": { "titleContent": { "columnMatch": "TotalEligibleGB", "formatter": 12, "formatOptions": { "palette": "coldHot" }, "numberFormat": { "unit": 39, "options": { "style": "decimal", "maximumFractionDigits": 2 } } }, "showBorder": false, "sortOrderField": 1 } }, "customWidth": "30", "conditionalVisibilities": [ { "parameterName": "TotalE5Seats", "comparison": "isNotEqualTo" }, { "parameterName": "TotalE5Seats", "comparison": "isNotEqualTo", "value": "0" } ], "name": "EligibleE5Ingestion" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let DailyMaxDiscountGB = ((5*toreal({TotalE5Seats}))/1024);\r\nUsage\r\n| where IsBillable == true\r\n| where DataType in (\"SigninLogs\", \r\n\"AuditLogs\", \r\n\"AADNonInteractiveUserSignInLogs\", \r\n\"AADServicePrincipalSignInLogs\",\r\n\"AADManagedIdentitySignInLogs\",\r\n\"AADProvisioningLogs\",\r\n\"ADFSSignInLogs\",\r\n\"McasShadowItReporting\", \r\n\"InformationProtectionLogs_CL\", \r\n\"DeviceEvents\",β€― \r\n\"DeviceFileEvents\",β€― \r\n\"DeviceImageLoadEvents\",β€― \r\n\"DeviceInfo\",β€― \r\n\"DeviceLogonEvents\",β€― \r\n\"DeviceNetworkEvents\",β€― \r\n\"DeviceNetworkInfo\",β€― \r\n\"DeviceProcessEvents\",β€― \r\n\"DeviceRegistryEvents\",\r\n\"DeviceFileCertificateInfo\",β€― \r\n\"EmailAttachmentInfo\",β€― \r\n\"EmailEvents\",β€― \r\n\"EmailPostDeliveryEvents\",β€― \r\n\"EmailUrlInfo\",\r\n\"IdentityLogonEvents\",\r\n\"IdentityQueryEvents\",\r\n\"IdentityDirectoryEvents\",\r\n\"AlertEvidence\",\r\n\"CloudAppEvents\") β€― \r\n| summarize DailyBillableGB = toreal(sum(Quantity))/ 1024 by format_datetime(TimeGenerated, 'yy-MM-dd') \r\n| summarize TotalEligibleGB = sum(iif(toreal(DailyBillableGB)>toreal(DailyMaxDiscountGB),toreal(DailyMaxDiscountGB),DailyBillableGB))\r\n| extend TotalDiscount = toreal(TotalEligibleGB)*{SentinelPrice}\r\n| project TotalDiscount\r\n\r\n", "size": 4, "title": "Estimated Saving", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "tiles", "tileSettings": { "titleContent": { "columnMatch": "TotalDiscount", "formatter": 12, "formatOptions": { "palette": "greenRed" }, "numberFormat": { "unit": 0, "options": { "currency": "GBP", "style": "currency", "maximumFractionDigits": 2 } } }, "showBorder": false } }, "customWidth": "20", "conditionalVisibilities": [ { "parameterName": "TotalE5Seats", "comparison": "isNotEqualTo", "value": "0" }, { "parameterName": "TotalE5Seats", "comparison": "isNotEqualTo" } ], "name": "EstimateE5Discount" }, { "type": 1, "content": { "json": "
\r\n**Daily ingestion size (for eligible data sources) vs Maximum data grant:**" }, "conditionalVisibilities": [ { "parameterName": "TotalE5Seats", "comparison": "isNotEqualTo", "value": "0" }, { "parameterName": "TotalE5Seats", "comparison": "isNotEqualTo" } ], "name": "text - DailyIngestionVsAllocation" } ] }, "conditionalVisibility": { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "Benefits" }, "name": "group - Sentinel Benefits" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "## SOAR summary\r\n\r\nIn this section, you can view billable information regarding your Logic Apps. The data is based on Logic Apps' built-in metrics. To view the list of Logic Apps click the \">\" icon in the subscription column.\r\n\r\nYou can change the default Logic App execution cost in the parameter below.\r\n\r\nTo see the approximate cost of your logic apps, **click on any subscription on the table below**.\r\n\r\nFor more billable information, visit: https://azure.microsoft.com/pricing/details/logic-apps/" }, "name": "text - 3" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "6f50ee54-8f0e-424e-9e16-70eca531af7f", "version": "KqlParameterItem/1.0", "name": "ResourceTypes", "label": "Resource types", "type": 7, "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "value": [ "microsoft.logic/workflows" ], "isHiddenWhenLocked": true, "typeSettings": { "additionalResourceOptions": [], "includeAll": true }, "timeContext": { "durationMs": 86400000 } }, { "id": "1c8dc8da-2233-426c-8cfc-52ec31bf1e84", "version": "KqlParameterItem/1.0", "name": "Subscription", "label": "Subscriptions", "type": 6, "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "query": "Resources\r\n| where type in~ ({ResourceTypes})\r\n| summarize Count = count() by subscriptionId\r\n| order by Count desc\r\n| extend Rank = row_number()\r\n| project value = subscriptionId, label = subscriptionId, selected = Rank == 1", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "showDefault": false }, "timeContext": { "durationMs": 86400000 }, "defaultValue": "value::all", "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "value": [ "value::all" ] }, { "id": "f103ef04-042e-45ed-8f78-b31e676258d7", "version": "KqlParameterItem/1.0", "name": "ResourceGroups", "label": "Resource groups", "type": 2, "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "query": "Resources\r\n| where type in~ ({ResourceTypes})\r\n| summarize Count = count() by subscriptionId, resourceGroup\r\n| order by Count desc\r\n| extend Rank = row_number()\r\n| project value = strcat('/subscriptions/', subscriptionId, '/resourceGroups/', resourceGroup), label = resourceGroup, selected = false", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "showDefault": false }, "timeContext": { "durationMs": 86400000 }, "defaultValue": "value::all", "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "value": [ "value::all" ] }, { "id": "b6514d02-8893-44b8-896e-e53ada5024d5", "version": "KqlParameterItem/1.0", "name": "Resources", "label": "Logic Apps", "type": 5, "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "query": "Resources\r\n| where type in~({ResourceTypes})\r\n| extend resourceGroupId = strcat('/subscriptions/', subscriptionId, '/resourceGroups/', resourceGroup)\r\n| where resourceGroupId in~({ResourceGroups}) or '*' in~({ResourceGroups})\r\n| order by name asc\r\n| extend Rank = row_number()\r\n| project value = id, label = tostring(name), selected = Rank <= 10, group = resourceGroup", "value": [ "value::all" ], "typeSettings": { "additionalResourceOptions": [ "value::all" ], "showDefault": false }, "timeContext": { "durationMs": 86400000 }, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources" }, { "id": "8f552e99-2d30-4679-b4b0-25429bf0216b", "version": "KqlParameterItem/1.0", "name": "ExecutionCost", "label": "Logic App execution cost", "type": 1, "isRequired": true, "value": "0.000125" } ], "style": "pills", "queryType": 1, "resourceType": "microsoft.resourcegraph/resources" }, "name": "parameters - 10" }, { "type": 10, "content": { "chartId": "workbooke70b7cbc-f1d7-4a74-b8b9-75cc8d5ab586", "version": "MetricsItem/2.0", "size": 1, "chartType": 0, "resourceType": "microsoft.logic/workflows", "metricScope": 0, "resourceParameter": "Resources", "resourceIds": [ "{Resources}" ], "timeContextFromParameter": "TimeRange", "timeContext": { "durationMs": 2592000000 }, "metrics": [ { "namespace": "microsoft.logic/workflows", "metric": "microsoft.logic/workflows--TotalBillableExecutions", "aggregation": 1 } ], "title": "Click on a subscription below to calculate the estimated automation costs", "resourceLimit": 10000, "gridSettings": { "formatters": [ { "columnMatch": "$gen_group", "formatter": 15, "formatOptions": { "linkTarget": null, "showIcon": true } }, { "columnMatch": "Subscription", "formatter": 5 }, { "columnMatch": "Name", "formatter": 13, "formatOptions": { "linkTarget": "Resource", "showIcon": true } }, { "columnMatch": "microsoft.logic/workflows--TotalBillableExecutions", "formatter": 8, "formatOptions": { "palette": "blue", "aggregation": "Sum" } }, { "columnMatch": "microsoft.logic/workflows--TotalBillableExecutions Timeline", "formatter": 21, "formatOptions": { "palette": "blue" } }, { "columnMatch": "microsoft.logic/workflows--BillableTriggerExecutions Timeline", "formatter": 5 }, { "columnMatch": "microsoft.logic/workflows--BillableActionExecutions", "formatter": 8, "formatOptions": { "palette": "blue" }, "numberFormat": { "unit": 0, "options": { "style": "decimal" } } }, { "columnMatch": "microsoft.logic/workflows--BillableActionExecutions Timeline", "formatter": 5 }, { "columnMatch": "RG", "formatter": 13, "formatOptions": { "linkTarget": null, "showIcon": true } }, { "columnMatch": "Sum", "formatter": 1, "formatOptions": { "aggregation": "Sum" }, "numberFormat": { "unit": 0, "options": { "style": "decimal" } } } ], "rowLimit": 10000, "filter": true, "hierarchySettings": { "treeType": 1, "groupBy": [ "Subscription" ] }, "labelSettings": [ { "columnId": "microsoft.logic/workflows--TotalBillableExecutions", "label": "Total Billable Executions (Sum)" }, { "columnId": "microsoft.logic/workflows--TotalBillableExecutions Timeline", "label": "Total Billable Executions Timeline" } ] }, "sortBy": [], "exportFieldName": "microsoft.logic/workflows--TotalBillableExecutions", "exportParameterName": "Total", "exportDefaultValue": "0" }, "name": "Billable Metric" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Usage | take 1 | project ['Estimated automation costs'] ={Total}*{ExecutionCost}", "size": 4, "title": "Estimated Logic App execution cost over the last {TimeRange}", "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": { "columnMatch": "Estimated automation costs", "formatter": 12, "formatOptions": { "palette": "greenRed" }, "numberFormat": { "unit": 0, "options": { "currency": "GBP", "style": "currency", "minimumFractionDigits": 2, "maximumFractionDigits": 3 } } }, "showBorder": false } }, "conditionalVisibility": { "parameterName": "Total", "comparison": "isNotEqualTo" }, "name": "query - 11" } ] }, "conditionalVisibility": { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "SOAR" }, "name": "group - SOAR " }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "## Commitment Tiers" }, "name": "text - 6" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "resources\r\n| where type =~ 'microsoft.operationalinsights/workspaces' \r\n| where id has \"{Workspace}\"\r\n| extend sku = tolower(properties.sku.name)\r\n| extend capacityReservationLevel = properties.sku.capacityReservationLevel\r\n// add fake level for testing\r\n//| extend capacityReservationLevel = 5000 , sku = \"capacityreservation\"\r\n//\r\n| extend pricingTier = case(\r\nsku == 'capacityreservation' and capacityReservationLevel == 100,\r\n'100 GB/day Commitment Tier',\r\nsku == 'capacityreservation' and capacityReservationLevel == 200,\r\n'200 GB/day Commitment Tier',\r\nsku == 'capacityreservation' and capacityReservationLevel == 300,\r\n'300 GB/day Commitment Tier',\r\nsku == 'capacityreservation' and capacityReservationLevel == 400,\r\n'400 GB/day Commitment Tier',\r\nsku == 'capacityreservation' and capacityReservationLevel == 500,\r\n'500 GB/day Commitment Tier',\r\nsku == 'capacityreservation' and capacityReservationLevel == 1000,\r\n'1000 GB/day Commitment Tier',\r\nsku == 'capacityreservation' and capacityReservationLevel == 2000,\r\n'2000 GB/day Commitment Tier',\r\nsku == 'capacityreservation' and capacityReservationLevel >= 5000,\r\n'5000 GB/day and above Commitment Tier',\r\nsku == 'free',\r\n'Free',\r\nsku == 'standard',\r\n'Standard',\r\nsku == 'premium',\r\n'Premium',\r\nsku == 'standalone',\r\n'Standalone',\r\nsku == 'pernode',\r\n'Per Node',\r\nsku == 'lacluster',\r\n'Cluster Level Capacity Reservation',\r\nsku == 'pergb2018' or sku == 'pergb',\r\n'Pay-as-you-go',\r\nstrcat('Unknown:',sku))\r\n| extend discountRate = case(\r\ncapacityReservationLevel == 100,50,\r\ncapacityReservationLevel == 200,55,\r\ncapacityReservationLevel == 300,57,\r\ncapacityReservationLevel == 400,58,\r\ncapacityReservationLevel == 500,60,\r\ncapacityReservationLevel == 1000,61,\r\ncapacityReservationLevel == 2000,63,\r\ncapacityReservationLevel >= 5000,65,\r\n// else\r\n0\r\n)\r\n| extend retentionInSentinel = iif({retentionDays} > 90,({retentionDays} -90) * {GBperday} * {Retention} ,toreal(0))\r\n| project ['Workspace Name']=id, location, sku, commitmentTier = capacityReservationLevel, discountRate , tags, dataRetention = {retentionDays}, dataRetentionMinusFree = {retentionDays}-90, RetentionEstimatedPrice = retentionInSentinel\r\n\r\n\r\n", "size": 4, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "crossComponentResources": [ "{Subscription}" ], "gridSettings": { "formatters": [ { "columnMatch": "RetentionEstimatedPrice", "formatter": 0, "numberFormat": { "unit": 0, "options": { "style": "decimal", "useGrouping": false, "maximumSignificantDigits": 3 } } } ] }, "sortBy": [] }, "conditionalVisibility": { "parameterName": "Workspace", "comparison": "isNotEqualTo" }, "name": "query - 16" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Usage\r\n| where IsBillable == True\r\n| summarize dataPerDay = sum(Quantity)/1000 by bin(TimeGenerated,1d), SentinelCT='{SentinelCap}'\r\n| extend higherCT = case(\r\n dataPerDay < 100, 100,\r\n dataPerDay > 100 and dataPerDay < 200, 200,\r\n dataPerDay > 200 and dataPerDay < 300, 300,\r\n dataPerDay > 300 and dataPerDay < 400, 400,\r\n dataPerDay > 400 and dataPerDay < 500, 500,\r\n dataPerDay > 500 and dataPerDay < 1000, 1000,\r\n dataPerDay > 1000 and dataPerDay < 10000, 10000,\r\n dataPerDay > 2000 and dataPerDay < 20000, 20000,\r\n dataPerDay > 5000 and dataPerDay < 50000, 50000,\r\n // else\r\n 0\r\n )\r\n//| extend lowerCT= (higherCT - 100)\r\n\r\n\r\n\r\n", "size": 1, "aggregation": 3, "showAnnotations": true, "title": "Actual Data Volume and Commitment Tier. Data from: {TimeRange:label}. ", "timeContextFromParameter": "TimeRange", "exportFieldName": "y", "exportParameterName": "yAxis", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "timechart", "gridSettings": { "formatters": [ { "columnMatch": "Column1", "formatter": 5 }, { "columnMatch": "dataPerDay", "formatter": 0, "numberFormat": { "unit": 0, "options": { "style": "decimal", "maximumSignificantDigits": 2 } } } ] }, "sortBy": [], "chartSettings": { "yAxis": [ "higherCT", "SentinelCT", "dataPerDay" ], "seriesLabelSettings": [ { "seriesName": "higherCT", "label": "Next Commitment Tier" }, { "seriesName": "SentinelCT", "label": "Actual Commitment Tier", "color": "purple" }, { "seriesName": "dataPerDay", "color": "green" } ], "ySettings": { "numberFormatSettings": { "unit": 0, "options": { "style": "decimal", "useGrouping": true, "maximumFractionDigits": 2 } } } } }, "name": "query - chart of CR" }, { "type": 1, "content": { "json": "### Commitment Tier Insight\r\nThis report, shows the Average GB/day (based on the TimeRange parameter), which is rounded up to the nearest whole number, this is the number the Azure Pricing Calculator requires. https://azure.microsoft.com/pricing/calculator/ for Sentinel.\r\n- The Pay as You Go (PAYG_estimate) is the GB/day multiplied by the [Sentinel Price] parameter, default is 2.0 (the price in $ for EAST US). This is location and currency neutral, so adjust to your own preferred value. This is the Daily estimate of the price.\r\n- The Pay as You Go (PAYG_estimate_mthly) is the Monthly (31day) estimate of the price.\r\n- Commitment Tier_Estimate_Monthly is the (PAYG_estimate_mthly) minus any discount for the commitment Tier that is *currently* set.\r\n- Data ingested into Sentinel exceeding the selected daily commitment tier is charged at the effective tier prices. source: https://azure.microsoft.com/pricing/details/azure-sentinel/" }, "name": "text - 5 - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": " project actual_ = '{GBperday}' , roundUp_ = round(toreal('{GBperday}'),0)\r\n| extend lookBack = 31\r\n| extend roundUp_ = iif(isnan(roundUp_),toreal(0),toreal(roundUp_))\r\n| extend PAYG_estimate = roundUp_ * {SentinelPrice}\r\n| extend discountRate = iif(isempty('{discountRate}'),\"0\",'{discountRate}') \r\n| extend PAYG_estimate_mthly = (PAYG_estimate * lookBack)\r\n| extend CT_estimate_mthly = PAYG_estimate_mthly * tolong(discountRate) / 100\r\n| summarize by ['avg GB/day']=roundUp_, PAYG_estimate, PAYG_estimate_mthly, CT_estimate_mthly", "size": 4, "aggregation": 5, "showAnnotations": true, "title": "Commitment Tier. Price per GB:{CommitmentTierPrice}, Discount: {discountRate}%", "exportFieldName": "y", "exportParameterName": "yAxis", "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "PAYG_estimate", "formatter": 0, "numberFormat": { "unit": 0, "options": { "style": "decimal", "maximumSignificantDigits": 2 } } }, { "columnMatch": "PAYG_estimate_mthly", "formatter": 0, "numberFormat": { "unit": 0, "options": { "style": "decimal", "useGrouping": false } } }, { "columnMatch": "avgDataPerDay", "formatter": 0, "numberFormat": { "unit": 0, "options": { "style": "decimal", "useGrouping": false, "maximumSignificantDigits": 2 } } }, { "columnMatch": "PAYG_estimate_daily", "formatter": 0, "numberFormat": { "unit": 0, "options": { "style": "decimal", "maximumSignificantDigits": 2 } } } ], "labelSettings": [ { "columnId": "CT_estimate_mthly", "label": "Commitment Tier estimate mthly", "comment": "Estimated Monthly price" } ] }, "sortBy": [] }, "name": "query - billing - Copy" }, { "type": 1, "content": { "json": "### Commitment Tier for your Average GB/day value? \r\nThis report helps you decide:\r\n- A green circle in a Status column 🟒 indicates your are on the Optimal setting, based on your average data ingestion (GB/day) and Pay As You Go/commitment tier settings.\r\n- A recommend value of \"0\" / zero, means that you are on a setting (SKU) such as Free, PerGB etc.. rather than a commitment tier setting.\r\n- If the 'recommend' Sentinel or Workspace setting doesn't match the 'current' setting you will get a Red Cross in the Status columns ❌.\r\n- Please read https://azure.microsoft.com/pricing/details/azure-sentinel/ and https://azure.microsoft.com/pricing/details/monitor/ before deciding. " }, "name": "text - 5" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": " project actual_ = '{GBperday}' , roundUp_ = round(toreal('{GBperday}'),0)\r\n| extend lookBack = 31\r\n| extend i = roundUp_ //* 100\r\n| extend i = iif(isnan(i),toreal(0),toreal(i))\r\n// Sentinel commitment tier logic\r\n| extend recommendedSentinelCT = case(\r\n i <= 50,\"0\",\r\n i between (51 .. 180),\"100\",\r\n i between (181 .. 286),\"200\",\r\n i between (287 .. 390),\"300\",\r\n i between (391 .. 476),\"400\",\r\n i between (477 .. 975),\"500\",\r\n i between (976 .. 1897),\"1000\",\r\n i between (1898 .. 4729),\"2000\",\r\n i >= 4730 ,\"5000\",\r\n //else\r\n strcat(\"unknown Sentinel CT: \", i)\r\n)\r\n// Azure Log Analytics (LAW) commitment tier logic\r\n| extend recommendedWorkspaceCT = case(\r\n i <= 85,\"0\",\r\n i between (86 .. 187),\"100\",\r\n i between (188 .. 293),\"200\",\r\n i between (294 .. 391),\"300\",\r\n i between (392 .. 491),\"400\",\r\n i between (492 .. 982),\"500\",\r\n i between (983 .. 1952),\"1000\",\r\n i between (1953 .. 4849),\"2000\",\r\n i >= 4850 ,\"5000\",\r\n //else\r\n strcat(\"unknown LAW CT: \", i)\r\n)\r\n| extend avgDataPerDay = i\r\n| extend currentSentinelCT = iif(isempty('{SentinelCap}'),\"0\",'{SentinelCap}')\r\n| extend currentWorkspaceCT = iif(isempty('{lawCap}'),\"0\",'{lawCap}')\r\n| extend sentinelOptimal = iif(recommendedSentinelCT == currentSentinelCT,1,0)\r\n| extend lawOptimal = iif(recommendedWorkspaceCT == currentWorkspaceCT,1,0)\r\n| summarize by ['avg GB/day']=avgDataPerDay,['Sentinel Status']=sentinelOptimal, ['Log Analytics Status']=lawOptimal, recommendedSentinelCT, recommendedWorkspaceCT,currentSentinelCT, currentWorkspaceCT", "size": 4, "title": "Commitment Tier Recommendations", "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "Sentinel Status", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "1", "representation": "success", "text": "" }, { "operator": "Default", "thresholdValue": null, "representation": "failed", "text": "" } ] }, "tooltipFormat": { "tooltip": "If Current and Recommended settings dont match the avg. GB/day - look to adjust? " } }, { "columnMatch": "Log Analytics Status", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "1", "representation": "success", "text": "" }, { "operator": "Default", "thresholdValue": null, "representation": "failed", "text": "" } ] }, "tooltipFormat": { "tooltip": "If Current and Recommended settings dont match the avg. GB/day - look to adjust? " } } ] } }, "name": "query - CR optimal" } ], "exportParameters": true }, "conditionalVisibility": { "parameterName": "selectedTab", "comparison": "isEqualTo", "value": "Commitment" }, "name": "group - Commitment" } ], "fromTemplateId": "sentinel-CostSummaryGBP", "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" }