Sentinel data lake
Can this table go to the data lake? Yes, no, or not yet.
Run one command in Cloud Shell and drop the file it makes onto this page. Every billable table then gets one answer: move it now, split it, check one thing first, or keep it. You see the evidence behind each answer and the saving at today's UK South prices. No score to chase, no app registration, and no rules switched off just to make a number go up.
Collect the evidence
The page needs four things: what each table ingests, which rules read it, who queries it from outside the portal, and current prices. One command collects all four.
- Open Cloud Shell in the Azure portal and pick PowerShell.
- Copy the command below and paste it in. It only reads, using your own sign-in. You need Microsoft Sentinel Reader and Log Analytics Reader on the workspace. Lighthouse access works too.
- When it says Done, go to Manage files → Download, type
lake-check.json, and drop that file below.
It collects 30 days of Usage, 30 days of LAQueryLogs, every analytics rule through the Sentinel API (paged, so 500 rules is no problem), and UK South GBP prices from the Azure Retail Prices API. Takes under a minute on most workspaces.
a. What you ingest
b. Who reads it from outside the portal
Needs query auditing on: workspace → Diagnostic settings → Audit → this workspace.
c. What your rules read
The portal exports at most 50 rules per file. Export in batches and drop all the files at once, or use the one-command tab, which has no limit.
Paste rule JSON instead
A few facts the logs can't tell us
Prices come from the Retail Prices API when you use the command. Without it the page falls back to the last checked UK South list prices.
Edit any price below and it switches to your own, saved in this browser.
From your file. Defaults to the workspace's own region.
Prices in that currency.
Analytics includes the first 90 days.
Advanced hunting retention. Decides what happens to XDR tables you stream into Sentinel.
£ a month. Cheaper tables go in a "small change" list.
Seats. 5 MB per user per day grant.
Servers. 500 MB per server per day.
Prices and assumptions
Only used for tables still on the Basic plan.
Billed on 6:1 compressed size.
How many times someone reads the table's whole month. Hunting in the lake isn't free.
Percent. The rows your rules actually filter for.
£ a month saved by a full move.
The answer
Click a box to filter. Click a table to see why, the arithmetic, and exactly where to click in the portal.
Behaviour follows Microsoft's documentation for the Sentinel data lake as at November 2026. Prices are list prices; EA and CSP agreements differ. A verdict here is evidence for a change request, not a replacement for one. © 2026 IT Professor. Free to use, not to republish.