Query Details
Threat Intelligence Table Costs
Query
//The cost of the Threat Intelligence table is nominal, but this query will show costs per month.
Usage
| where DataType == "ThreatIntelligenceIndicator"
| where TimeGenerated > ago(90d)
| summarize BillableDataGB = sum(Quantity) / 1000. by Year = tostring(bin(datepart("Year", TimeGenerated), 1)), Month = bin(datepart("Month", TimeGenerated), 1)
| sort by Year, Month asc
Explanation
This query calculates the monthly costs of the Threat Intelligence table. It filters the data to only include entries with the DataType "ThreatIntelligenceIndicator" and within the last 90 days. Then, it groups the data by year and month, and calculates the sum of the Quantity divided by 1000 to get the billable data in GB. Finally, it sorts the results by year and month in ascending order.
Details
Rod Trent
Released: November 9, 2021
Tables
Usage
Keywords
ThreatIntelligenceIndicator,Usage,DataType,TimeGenerated,BillableDataGB,Quantity,Year,Month
Operators
| where====>ago()| summarize=sum()/bytostring()bin()datepart()sort byasc