Based on these numbers I can quickly calculate estimates for 3000 user environment. Because LA is not used for long-term storage unexpected costs can be avoided with the correct data retention policy.ĭata and examples in the table below are from.
The following table describes the estimated costs for Log Analytics (LA) usage in a defined scenario.
Log data is still stored in a Log Analytics workspace and is still collected and analyzed by the same Log Analytics service. They want to send Azure AD Sign-in & Audit logs to destinations below, how much does it add Azure consumption for selected components?ītw, Microsoft recently started using the term Azure Monitor logs instead of Log Analytics. In the following examples, there are hypothetical organizations with 100k, 7k, and 3k users. If only alerts are needed use Intelligent Security Graph (ISG) to get alerts from the cloud to the SIEM system.Archive Azure AD activity logs to an Azure storage account, to retain the data for a long time.Send Azure AD activity logs to Azure Monitor (aka Log Analytics) logs to enable rich visualizations, monitoring and alerting.Stream Azure AD activity (sign-in & audit) logs to an Azure Event Hub and integrate logs to Security Information and Event Management (SIEM) tools for analytics, such as Splunk and QRadar (consider leveraging Azure Sentinel, at least collecting all events from the cloud).I have personally followed these guidelines when planning log integrations which follow Microsoft best practices: This is a matter of different blog post in 2020. When planning log integration it’s important to look at the big picture, from which sources your organization wants to send events to SIEM and how much you want to leverage tools available in the cloud. On-prem SIEM system (such as Splunk and Qradar).Event Hub Namespace with at least one Event Hub.Azure Monitor aka Log Analytics implemented (this is optional but recommendable).For that reason, I decided to write a short blog post about the topic. My customer asked me to calculate Azure consumption costs (before implementation) for Azure AD audit & sign-in log integration to Event Hub, Log Analytics and Storage Account when the final destination is on-premises SIEM system.
0 kommentar(er)
