• #SIEM

• https://docs.microsoft.com/en-us/azure/sentinel/azure-sentinel-billing

// Billable performance data over the last 30 days

Usage
| where TimeGenerated > ago(30d)
| where IsBillable == true
| summarize TotalVolumeGB = sum(Quantity) / 1024

• Kusto Query Language (KQL)