Cost Of A Table

// Author: Ian D. Hanley (DevSecOpsDad) | linkedin.com/in/ianhanley | devsecopsdad.com | devsecopsdadattack.com
// This query will tell you how much a given table will cost you
// For this query, the 'rate' acts like a global floating point variable which is manually defined.
// The rate for your region can be found here: https://azure.microsoft.com/en-us/pricing/details/microsoft-sentinel/
// You can calculate the LAW cost, Sentinel cost, or both (effective cost per GB) by setting the rate variable
// This doesn't have to be over 30 days, you can adjust the TimeGenerated parameter to a a week (7d), a day (1d), or even hourly (1h) etc.
// Source: Sentinel Cost Optimization Part 2 (2023-05-15) — https://www.hanley.cloud/2023-05-15-Sentinel-Cost-Optimization-Part-2/
// Platforms: Microsoft Sentinel
// Data: Usage

let rate = 4.30;                                  //<-- Effective per GB Price in EastUS (LAW & Sentinel per GB cost combined)
SecurityEvent                                     //<-- We're querying the SecurityEvent table in this one
| where TimeGenerated >ago(30d)                   //<-- Let's look at the past month, which makes sense considering we're billed monthly
| summarize GB=sum(_BilledSize)/1000/1000/1000    //<-- Summarize billable volume in GB using the _BilledSize table column
| extend cost = GB*rate                           //<-- Multiply total GBs for the month by the effective rate (defined in first line of query)

//You can change the second to last line in the above query to the following if you’re a stickler for Gibibytes versus Gigabytes: 
| summarize GB=sum(_BilledSize)/1024/1024/1024