MS Ai Insider

Maximize Cost Efficiency in Microsoft Sentinel: Strategies for Log Ingestion and Management

Posted by

ailona

–

September 2, 2024

1. *In a recent blog post, Microsoft discusses cost-saving strategies for log ingestion in Microsoft Sentinel. By splitting logs into multiple tables and utilizing the Basic tier, users can effectively manage expenses. The article outlines various log plans, including Analytics, Basic, and Auxiliary logs, and offers practical steps for implementing these changes.2. **:**

“`html

Optimize Your Log Management with Microsoft Sentinel

In an era where data is king, managing log ingestion costs is crucial. Microsoft has introduced a cost-effective strategy for users of Microsoft Sentinel. This involves splitting logs into multiple tables and opting for the Basic tier. Let’s explore this innovative approach.

What’s New?

Microsoft has revamped its log plans to provide users with more flexibility and cost-saving options. The introduction of Basic Logs is a game-changer. It supports richer troubleshooting and incident response while significantly reducing costs. Also, the retention period has been extended, allowing users to keep logs longer without incurring hefty fees.

“Basic Logs have been improved to support even richer troubleshooting and incident response with fast queries while saving costs.”

Major Updates in Log Plans

Azure Monitor now offers three distinct log plans:

Analytics Logs: Designed for frequent access and optimized for critical logs.
Basic Logs: Ideal for cost-saving without compromising on functionality.
Auxiliary Logs: A new, inexpensive option for verbose logs needed for compliance.

Understanding these plans allows users to make informed decisions about their log management strategy. For example, Analytics Logs support all tables, while Basic Logs are compatible with DCR-based custom tables and some Azure tables.

What’s Important to Know?

To effectively manage costs, it’s essential to analyze your logs. High-volume logs, such as Firewall logs, can significantly inflate ingestion costs. By switching these logs to the Basic log plan, users can save substantially.

Here are the steps to achieve this:

Ingest Firewall logs to Microsoft Sentinel using the Azure Monitor Agent.
Create a custom table mirroring the Syslog table schema.
Update the Data Collection Rule (DCR) template to split the logs.
Set the table plan to Basic for the new DCR-based custom table.

“I highly recommend reviewing the PowerShell script thoroughly and doing proper testing before executing it in production.”

Conclusion

By splitting logs into multiple tables and utilizing the Basic tier, organizations can significantly reduce their log ingestion costs. This strategic approach not only enhances efficiency but also ensures compliance. Dive into Microsoft Sentinel’s new log plans and start optimizing your log management today!

“`

Microsoft Sentinel users can reduce ingestion costs by splitting logs into multiple tables.

Different log plans available include Analytics Logs, Basic Logs, and Auxiliary Logs.

Basic Logs support longer retention periods and enhanced troubleshooting capabilities.

Custom tables can be created using a PowerShell script to streamline the process.

Users are encouraged to assess which logs can transition to the Basic log plan for cost efficiency.

“`

From the Core Infrastructure and Security Blog