Top 10 Common Security Logs By Severity With Cost

// Author: Ian D. Hanley (DevSecOpsDad) | linkedin.com/in/ianhanley | devsecopsdad.com | devsecopsdadattack.com
// Top 10 most expensive CommonSecurityLog groupings by DeviceVendor, DeviceProduct, and LogSeverity
// over the last 30 days, with numeric CostUSD. Best for spotting which vendor/product/severity
// combos are driving your CEF/Syslog appliance cost.
// For a Reason-focused enhanced variant with cost-tier emojis, see the -enhanced-by-reason file
// in the same folder.

let PricePerGB = 5.16;   // <-- Replace with your region's actual Sentinel price per GB
CommonSecurityLog
| where TimeGenerated > ago(30d)
| where _IsBillable == true
| summarize TotalGiB = round(sum(_BilledSize) / 1024.0 / 1024.0 / 1024.0, 2)
          by DeviceVendor, DeviceProduct, LogSeverity
| extend CostUSD = round(TotalGiB * PricePerGB, 2)
| top 10 by CostUSD desc
| order by CostUSD desc