Cost & Ingest

 KQL Library / Cost & Ingest

Cost & Ingest

The FinOps side of Sentinel and Log Analytics — how much you're ingesting, where it's coming from, and what it's costing you. Everything here targets the `Usage` table, `_BilledSize`, or specific noisy sources.

← All KQL categories

Billable Volume

Raw billable-volume queries — how many GB per day, per table, per solution — plus the "efficiency exercise" that walks through why some formulations of these questions are much cheaper to run than others.

• 90 Day Billable Cost Per Day Formatted 90-day-billable-cost-per-day-formatted.kql

  Daily billable GB and cost over 90 days, formatted as human-readable strings (`$X.XX / Day`, `XGB / Day`). Table-friendly, not chart-friendly.

• 90 Day Billable Cost Per Day 90-day-billable-cost-per-day.kql

  Daily billable GB and cost over 90 days with numeric `CostUSD`. The default cost-over-time view — plottable and aggregatable.

• 90 Day Billable Volume By Solution 90-day-billable-volume-by-solution.kql

  Billable GB per day for the past 90 days, sliced by Solution, rendered as a column chart.

• Efficiency Exercise efficiency-exercise.kql

  Teaching walkthrough of the "average daily ingest" question written four ways, from a slow `search *` to an efficient `Usage`-scoped version with cost. Read this before writing your own daily-average query.

• GB Per Table gb-per-table.kql

  Ingest volume in GB for a single table (defaults to `SecurityEvent`, swap as needed).

Cost By Eventid

Cost broken down at the Event ID or Syslog-severity level — for when you need to justify filtering a specific noisy event out at the DCR.

• Cost Of Eventid By Computer cost-of-eventid-by-computer.kql

  Breaks the cost of a specific Event ID out by originating computer (defaults to `EventID == 4672`).

• Cost Of Eventid cost-of-eventid.kql

  Estimated cost of a single Event ID over a time window, using your effective per-GB rate.

• Cost Of Syslog Events By Severity cost-of-syslog-events-by-severity.kql

  Cost of Syslog events grouped by severity level.

• Eventid By Billedsize eventid-by-billedsize.kql

  Ingest volume in GB per Event ID from the `SecurityEvent` table.

• Top 10 Eventids Windows Securityevents top-10-eventids-windows-securityevents.kql

  Top 10 most expensive Event IDs from the `SecurityEvent` table over the last 90 days.

• Top 10 Windowsevent Eventids top-10-windowsevent-eventids.kql

  Top 10 most expensive Event IDs from the `WindowsEvent` table (AMA-shipped) over the last 90 days.

Cost By Table

Cost broken down by table or log source. Most of these use a manually-set `rate` variable that you should set to your region's effective per-GB price ([Sentinel pricing](https://azure.microsoft.com/en-us/pricing/details/microsoft-sentinel/)).

• Cost Of A Table cost-of-a-table.kql

  Estimated dollar cost of a single table over a chosen window, given your effective per-GB rate.

• Cost Of Workstations Logging Direct To Sentinel cost-of-workstations-logging-direct-to-sentinel.kql

  Find workstations shipping logs directly to Sentinel and estimate what it's costing you.

• How Loud Is A Table how-loud-is-a-table.kql

  Row-count-per-day graph for a given table (defaults to `Syslog`) — a quick "is this table getting louder?" check.

• Top 10 Billable MDE Tables top-10-billable-mde-tables.kql

  Top 10 most expensive Microsoft Defender for Endpoint tables over the last 90 days.

• Top 10 Common Security Logs By Reason With Cost Enhanced top-10-common-security-logs-by-reason-with-cost-enhanced.kql

  Top `CommonSecurityLog` rows by `Reason` and `LogSeverity` (90d), ranked by event count, with an emoji cost-tier column. Filters out empty/`N/A` reasons.

• Top 10 Common Security Logs By Severity With Cost top-10-common-security-logs-by-severity-with-cost.kql

  Top `CommonSecurityLog` groupings by `DeviceVendor`, `DeviceProduct`, and `LogSeverity` (30d), with numeric `CostUSD`.

• Top 10 Log Sources With Cost Enhanced top-10-log-sources-with-cost-enhanced.kql

  Top log sources by `DataType` (30d) with an emoji cost-tier and formatted `$X.XX` string — table/dashboard friendly.

• Top 10 Log Sources With Cost top-10-log-sources-with-cost.kql

  Top log sources by `DataType` (30d) with numeric `CostUSD`. The chart-friendly default.

• Top 10 Security Events With Cost Enhanced top-10-security-events-with-cost-enhanced.kql

  Top `SecurityEvent` `EventID`s (30d) with GiB, emoji cost-tier, and formatted `$X.XX` string.

• Top 10 Security Events With Cost top-10-security-events-with-cost.kql

  Top `SecurityEvent` `EventID`s with `Activity` (30d) and numeric `CostUSD`.

• Top 10 Tables Exclude MDE top-10-tables-exclude-mde.kql

  Top 10 most expensive log sources over 90 days, excluding MDE, via the fast `Usage` table.

Ingest Trends

Queries that compare ingest volume across time windows to spot upward drift, new noisy sources, or budget-eating trends.

• 30 60 90 Day Common Security Log Ingest Trends 30-60-90-day-common-security-log-ingest-trends.kql

  Compare `CommonSecurityLog` volume by `DeviceAction` across 30-, 60-, and 90-day periods to spot which actions are driving growth.

• 30 60 90 Day Ingest Trends 30-60-90-day-ingest-trends.kql

  Same three-window comparison against the `Usage` table for a workspace-wide view.

• Day By Day Change day-by-day-change.kql

  Percent change in daily ingest volume vs the previous day over the last 31 days.

• Log Sources With Greatest Delta log-sources-with-greatest-delta.kql

  Which data sources moved the most between the previous 30 days and the current 30 days — the "who suddenly got loud" query.