Sentinel IngestIQ - Cost Calculator

Environment Parameters

Enter your infrastructure details

Identity & Server Infrastructure

Active Directory, Entra ID, and server assets

AD / Entra ID Users (count)

Domain Controllers (count)

Windows Servers (w/o DCs)

Linux Servers (count)

Hypervisor Servers (ESXi/HV/KVM)

Applications & Security Services

Business applications, proxies, and security tooling

# of Business Apps (ServiceNow, Jira, SAP…)

Network Access Control in use? e.g. Cisco ISE, Aruba ClearPass

Web Proxy / SWG in use? e.g. Zscaler, Forcepoint, Squid

Other Security Products (count)

Network Infrastructure

Firewalls, switches, access points, and routers

FW - Normal Site (Edge)

FW - Normal Site (Segm.)

FW - Small Site (Edge)

FW - Small Site (Segm.)

Firewall Deployment

Standalone

Cluster (HA)

Network Devices (Switches, APs, Routers)

Microsoft Licensing

License tier significantly impacts data volumes and free sources

Microsoft License Tier

Step 1 - Gross Daily Ingestion Estimate

Based on your environment parameters

-
Total GB / Day

-

GB / Hour (Peak 12h)

-

GB / Hour (Off-Peak 12h)

-

Estimated GB / Month

Gross Costs at Pay-As-You-Go rate € 4.80 / GB (EU West) - without any benefits or free data source deductions.

-

Gross Cost / Day

-

Gross Cost / Month

-

Gross Cost / Year

TOTAL

-

100%

Calculation Factors (click to adjust)

Step 2 - Cost Estimate & Free Data Source Optimization

Pay-As-You-Go pricing with included free data sources

Pay-As-You-Go ingestion price: € 4.80 / GB (region: EU West). Microsoft Sentinel includes several free data sources that are not billed.

-

Gross Cost / Day

- / month

-

Free Source Savings / Day

- / month

-

Billable Cost / Day

- / month

Included Free Data Sources

No ingestion cost

Gross vs. Billable Ingestion

Gross Ingestion- GB

Free Data Sources- GB

Billable Ingestion- GB

-

TOTAL

-

Step 3 - Microsoft 365 E5 Security Benefit

5 MB free ingestion per E5 user/day on eligible data sources

Each Microsoft 365 E5 / E5 Security license includes 5 MB/user/day of free data ingestion for eligible Microsoft security data sources.

Eligible Data Sources (E5 Grant)

5 MB/user/day

-

E5 Grant / Day

- users × 5 MB

-

E5 Savings / Day

- / month

-

Billable Cost / Day (after all benefits)

- / month

Cost Waterfall - All Benefits Applied

Gross Cost-

After Free Sources (Step 2)-

After E5 Benefit (Step 3)-

-

Step 4 - Microsoft Defender for Cloud P2 Benefit

500 MB free ingestion per server/day on eligible security data sources

Microsoft Defender for Servers P2 includes 500 MB/server/day of free data ingestion for eligible security tables. Upgrade from P1 costs €10/server/mo additional.

Enable Defender for Cloud P2 Benefit

Activate to see savings from 500 MB/server/day grant on eligible security data

Eligible Data Sources (MDC P2 Grant)

500 MB/server/day

-

MDC P2 Grant / Day

- servers × 500 MB

-

Ingestion Savings / Day

- / month

-

Effective Cost / Day (incl. license cost)

- / month

ROI Analysis - Is MDC P2 Worth It?

MDC P2 Upgrade Cost

-

- servers × €10/mo

Ingestion Savings

-

from 500 MB/server/day grant

Net Benefit / Month

-

Savings − Upgrade Cost

Cost Waterfall - All Benefits Applied

Gross Cost-

After Free Sources (Step 2)-

After E5 Benefit (Step 3)-

After MDC P2 Benefit (Step 4)-

+ MDC P2 License Cost-

Effective Total Cost-

-

Step 5 - Auxiliary Logs / Data Lake Optimization

Reduce costs by routing high-volume, low-value data to Auxiliary Logs

Auxiliary Logs (Data Lake Tier) allow ingestion at €0.40/GB instead of €4.80/GB. Data can be queried on-demand but is not available for real-time KQL analytics or scheduled rules.

Enable Auxiliary Logs Optimization

Activate to model cost savings from routing selected log sources to the Data Lake tier (€0.40/GB)

Step 6 - Total Cost Overview & Final Optimization

Complete cost breakdown with Commitment Tier & Pre-Purchase Plan options

This final step shows a complete cost breakdown per log category after all benefits. Use the Commitment Tier and Pre-Purchase Plan options below to further optimize your costs.

Final Cost per Log Category

TOTAL

-

Top Cost Drivers (after all benefits)

Apply Commitment Tier DiscountANALYTICS TIER ONLY

Select a Commitment Tier based on your estimated daily Analytics Tier volume

Apply Pre-Purchase Plan DiscountANALYTICS TIER ONLY

Buy Sentinel Commit Units (CUs) upfront for additional savings

Final Cost Summary

-

Gross Cost / Day (PAYG)

- / month

-

Total Savings / Day

- / month

-

Final Cost / Day

- / month

-

Final Cost / Year

-

Commercial Cost Overview

Professional cost breakdown for budgeting and proposals.

Cost Position	Type	Amount	Frequency	Notes

12-Month Cost Projection

-

Estimated Total Cost - First 12 Months

-

Avg. Effective Monthly Cost

-

vs. Gross PAYG (12 months)

-

Sentinel - IngestIQ

Pre-Release Access Required

Microsoft Sentinel - IngestIQ

Environment Parameters

Identity & Server Infrastructure

Applications & Security Services

Network Infrastructure

Microsoft Licensing

Step 1 - Gross Daily Ingestion Estimate

Step 2 - Cost Estimate & Free Data Source Optimization

Included Free Data Sources

Gross vs. Billable Ingestion

Step 3 - Microsoft 365 E5 Security Benefit

Eligible Data Sources (E5 Grant)

Cost Waterfall - All Benefits Applied

Step 4 - Microsoft Defender for Cloud P2 Benefit

Eligible Data Sources (MDC P2 Grant)

ROI Analysis - Is MDC P2 Worth It?

Cost Waterfall - All Benefits Applied

Step 5 - Auxiliary Logs / Data Lake Optimization

Log Source Optimization

Cost Waterfall - All Benefits + Auxiliary Logs

Step 6 - Total Cost Overview & Final Optimization