Microsoft Security Operations AnalystMitigate threats using Microsoft SentinelHard
A security engineer is tasked with optimizing the cost of Microsoft Sentinel. The current ingestion rate is 100 GB per day, and the organization has a commitment tier of 50 GB per day. Any data ingested beyond the commitment tier is billed at a pay-as-you-go rate. The engineer observes that a significant portion of the ingested data consists of verbose debug logs from non-critical applications that are rarely used for security investigations. What is the most effective strategy to reduce Sentinel ingestion costs related to these specific logs?
- AUse Azure Data Explorer to store the debug logs instead of Sentinel.
- BIncrease the commitment tier to match the current ingestion rate.
- CApply data transformation to filter out the verbose debug logs before ingestion.
- DChange the retention period for the debug logs to a shorter duration.
Show answer & explanationAnswer & explanation
Correct answer: C. Apply data transformation to filter out the verbose debug logs before ingestion.
Data transformation allows filtering out irrelevant data (like verbose debug logs) *before* it is ingested into Log Analytics/Sentinel. This directly reduces the volume of billed ingestion, which is the most effective way to reduce costs for unnecessary data.
Why the other options are wrong
- A. Using Azure Data Explorer would shift the storage cost but not reduce the ingestion cost into Sentinel, or it would require a separate analytics solution, not optimizing Sentinel itself.
- B. Increasing the commitment tier would reduce the pay-as-you-go rate for the excess, but not eliminate the cost of ingesting unnecessary data.
- D. Changing retention affects storage costs, not ingestion costs. The data is already ingested and billed.
Microsoft Sentinel Cost Optimization - Ingestion
Optimizing Sentinel ingestion costs involves reducing the volume of data sent to Log Analytics. This can be achieved by filtering irrelevant data at the source or using ingestion-time transformations.
- Billed primarily on data ingestion volume.
- Commitment tiers offer discounted rates for predictable usage.
- Filter out unnecessary data *before* ingestion to save most effectively.
Memory trick: Filter First, Then Fund Savings