Forum Discussion
Sentinel Billable data
Hello can you please help me understand difference of two queries we received from vendor deployin sentinel. We have logic app running daily this query to see billable data (to monitor if we are...
For query one, you only need this KQL for the same result.
Usage
| where TimeGenerated > ago(1d)
| where IsBillable == true
| summarize BillableDataGB = sum(Quantity) / 1000.
However you may be better off adding a time alignment, as you dont say when the Playbooks runs, and you will get different results depending on the time of day, however if you add startofday() you always get from the first record after midnight. See here for more How to align your Analytics with time windows in Azure Sentinel using KQL (Kusto Query Language) - Microsoft Tech Community
Usage
| where TimeGenerated > startofday(ago(1d))
| where IsBillable == true
| summarize BillableDataGB = sum(Quantity) / 1000.
