Cost & Ingest
Cost By Eventid
cost-of-eventid-by-computer.kql
Breaks the cost of a specific Event ID out by originating computer (defaults to `EventID == 4672`).
// Author: Ian D. Hanley (DevSecOpsDad) | linkedin.com/in/ianhanley | devsecopsdad.com | devsecopsdadattack.com
WindowsEvent
| where TimeGenerated >ago(90d)
| where EventID == "4672"
| where _IsBillable == True //<-- Filter out non-billable data
| summarize Billable_GB=round(sum(_BilledSize / 1000 / 1000 / 1000),2) by Computer, EventLevelName
| extend TotalCost = round(Billable_GB * 5.59, 2)
| extend TotalCost=strcat('$', TotalCost)
| sort by Billable_GB desc //<-- Display results in descending order
| limit 10