Microsoft Sentinel
Cloud and workloadsUnderstand Threat Intelligence
In brief
The page now states that re-ingestion costs follow standard log ingestion pricing for paid tables, with final costs affected by tenant discounts or commitment tiers.
What Defender admins need to know
Administrators can use this information when estimating re-ingestion costs for their tenants.
Summaries are generated from the documentation change itself.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
The Id property is a concatenation of the base64-encoded SourceSystem value, --- (three dashes), and the stixId (which is the Data.Id value).
Cost for this re-ingestion matches the standard log ingestion pricing for paid tables. Note: Your exact final cost will reflect any tenant-level discounts or commitment tiers currently active on your account.
View your GeoLocation and WhoIs data enrichments (public preview)
Microsoft enriches IP and domain indicators with extra GeoLocation and WhoIs data to provide more context for investigations where the selected IOC is found.
@@ -266,6 +266,8 @@ When an indicator is created, updated, or deleted, Microsoft Sentinel creates a
The `Id` property is a concatenation of the base64-encoded `SourceSystem` value, `---` (three dashes), and the `stixId` (which is the `Data.Id` value).
+Cost for this re-ingestion matches the standard log ingestion pricing for paid tables. Note: Your exact final cost will reflect any tenant-level discounts or commitment tiers currently active on your account.
+
### View your GeoLocation and WhoIs data enrichments (public preview)
Microsoft enriches IP and domain indicators with extra `GeoLocation` and `WhoIs` data to provide more context for investigations where the selected IOC is found.