Query

Operation
| where OperationKey == "Benefit type used: SentinelMicrosoft365"

About this query

Microsoft Sentinel - E5 Security benefit

Query Information

Description

Use the below query to identify when the Sentinel E5 Security benefit is used.

References

Microsoft Sentinel benefit for Microsoft 365 E5, A5, F5, and G5 customers
[Microsoft Sentinel]

Each user has a Data Grant of 5 MB per day with the E5 Benefit. The query below shows the total GB and total Users.

Operation
| where OperationKey == "Benefit type used: SentinelMicrosoft365"
| extend GBUsed = toreal(extract(@"Benefit amount used: (\d+\.\d+) GB", 1, Detail))
| summarize TotalGBUsed = sum(GBUsed)
| extend TotalUsers = (TotalGBUsed * 1024) / 5

Explanation

This query is designed to help you identify and analyze the usage of the Microsoft Sentinel E5 Security benefit. Here's a simple breakdown of what the query does:

Identify Usage: The first part of the query filters the data to find instances where the Sentinel E5 Security benefit is used. It specifically looks for operations labeled with the key "Benefit type used: SentinelMicrosoft365".
Calculate Total GB Used: It extracts the amount of data (in gigabytes) used from the operation details and converts it into a numerical format. Then, it calculates the total amount of data used in gigabytes by summing up all the extracted values.
Estimate Total Users: Based on the total gigabytes used, it estimates the number of users who have utilized this benefit. Each user is assumed to have a data grant of 5 MB per day. The query converts the total gigabytes used into megabytes and divides by 5 to estimate the total number of users.

In summary, this query helps you understand how much of the Sentinel E5 Security benefit has been used in terms of data volume and provides an estimate of how many users have utilized this benefit.

KQL Search