Your Microsoft Sentinel bill tripled and the team says nothing changed. Someone did change something. This video walks the 5-step path to the culprit (meter, day, table, source, event), the rate trap that raises the bill without more gigabytes, the fixes (filter at the source, data lake tier, commitment tier sizing) and the guardrails (volume alert, budget, daily cap used carefully).
What the video covers
- Your Sentinel bill tripled (0:00)
- Who pays for a Sentinel spike (0:19)
- How Sentinel pricing works (0:44)
- Lab: 3 GB a day becomes 14 (1:14)
- Find the meter in Cost analysis (1:37)
- Find the spike day (Usage table) (1:47)
- Find the table that grew (1:56)
- Find the machine (_BilledSize) (2:09)
- Find the noisy event IDs (2:22)
- Free trial and commitment rate trap (2:32)
- Filter logs at the source (2:44)
- Cost saved and results (3:17)
- Volume alert, budget, daily cap (3:36)
- Recap (3:58)
KQL used in the video
Run these in Log Analytics (Logs) on the Sentinel workspace, in this order. Lab names; swap in your own machine names.
// Step 2: find the spike day (billable GB per day)
Usage
| where TimeGenerated between (ago(32d) .. now())
| where IsBillable == true
| summarize BillableGB = sum(Quantity) / 1000. by bin(TimeGenerated, 1d)
| render columnchart
// Step 3: find the table that grew (this week vs last week)
Usage
| where TimeGenerated between (ago(14d) .. now())
| where IsBillable == true
| summarize ThisWeekGB = sumif(Quantity, TimeGenerated between (ago(7d) .. now())) / 1000.,
LastWeekGB = sumif(Quantity, TimeGenerated between (ago(14d) .. ago(7d))) / 1000.
by DataType
| extend GrowthGB = ThisWeekGB - LastWeekGB
| sort by GrowthGB desc
// Step 4: find the source (billed size per machine)
SecurityEvent
| where TimeGenerated between (ago(7d) .. now())
| where _IsBillable == true
| summarize BillableGB = sum(_BilledSize) / 1e9 by Computer
| sort by BillableGB desc
| take 10
// Step 4b: same for CEF/syslog devices
CommonSecurityLog
| where TimeGenerated between (ago(7d) .. now())
| where _IsBillable == true
| summarize BillableGB = sum(_BilledSize) / 1e9 by Computer, DeviceVendor, DeviceProduct
| sort by BillableGB desc
| take 10
// Step 5: find the noisy event IDs on that machine
SecurityEvent
| where TimeGenerated between (ago(7d) .. now())
| where Computer == "LAB-WIN11-01"
| summarize Events = count(), BillableGB = sum(_BilledSize) / 1e9 by EventID
| sort by BillableGB desc
| take 10
// Guardrail: volume alert (log alert rule, runs once a day)
// 6 = about twice a normal day in the lab; set your own baseline
Usage
| where TimeGenerated between (ago(1d) .. now())
| where IsBillable == true
| summarize BillableGB = sum(Quantity) / 1000.
| where BillableGB between (6.0 .. 100000.0)
Sources (Microsoft Learn, checked 2026-10-29)
- Plan costs and understand Microsoft Sentinel pricing and billing: https://learn.microsoft.com/en-us/azure/sentinel/billing
- Reduce costs for Microsoft Sentinel: https://learn.microsoft.com/en-us/azure/sentinel/billing-reduce-costs
- Set a daily cap on a Log Analytics workspace: https://learn.microsoft.com/en-us/azure/azure-monitor/logs/daily-cap
- Analyze usage in a Log Analytics workspace: https://learn.microsoft.com/en-us/azure/azure-monitor/logs/analyze-usage
Lab names and made-up numbers only (contoso.com). No prices: they change by region.
Where did your last Sentinel ingestion spike come from? Tell me in the comments, or watch the full video here: https://youtu.be/xXQOidCbvQI
Thanks for reading! I'm Cuong, and on CD Security Lab I rebuild real Microsoft security cases in a safe lab and explain them simply. Follow along:
- ▶️ YouTube (daily Shorts + explainers): CD Security Lab
- 💼 LinkedIn: Cuong Do
- 📘 Facebook: CD Security Lab
- 📸 Instagram: @cdsecuritylab
- 📝 More posts like this: Dev.to
Got a question about your own tenant? Drop it in the comments.
Top comments (0)