Cost & Ingest
Cost By Eventid
top-10-windowsevent-eventids.kql
Top 10 most expensive Event IDs from the `WindowsEvent` table (AMA-shipped) over the last 90 days.
// Author: Ian D. Hanley (DevSecOpsDad) | linkedin.com/in/ianhanley | devsecopsdad.com | devsecopsdadattack.com
// This query will break down your top 10 most expensive EventIDs from the Windows Event table over the last 90 days
// East US Region | 100GB/Day commitment tier | Effective Cost per GB - https://azure.microsoft.com/en-ca/pricing/details/microsoft-sentinel/?cdn=disable
WindowsEvent
| where TimeGenerated >ago(90d) //<-- Run this query against the past quarter (90 days)
| where _IsBillable == True //<-- Filter out non-billable data
| summarize EventCount=count(), Billable_GB=round(sum(_BilledSize/1000/1000/1000),2) by EventID
| sort by Billable_GB desc //<-- Display results in descending order
| extend Estimated_Cost=round(Billable_GB*cost, 2) //<-- Create a column (extend) and fill it with results of "Billable_GB x cost" where cost is referenced above
| sort by Billable_GB desc //<-- Sort by GB in descending order
| limit 10 //<-- Limit results to top 10 entries