Sentinel Log Analytics Ingestion Quota Configuration

Sentinel Ingestion Quota

Query

arg("").Resources
| where type == "microsoft.operationalinsights/workspaces"
| extend SKUName = tostring(parse_json(tostring(properties.sku)).name)
| extend dailyQuotaGb = tostring(parse_json(tostring(properties.workspaceCapping)).dailyQuotaGb)
| extend quotaNextResetTime = todatetime(tostring(parse_json(tostring(properties.workspaceCapping)).quotaNextResetTime))
| extend retentionInDays = tostring(properties.retentionInDays)
| project name, location, resourceGroup, retentionInDays,SKUName, dailyQuotaGb, quotaNextResetTime

About this query

Sentinel Log Analytics Ingestion Quota Configuration

Query Information

Description

Use the below queries to retreive log analytics ingestion quota configuration information and changes

References

Set daily cap on Log Analytics workspace

Microsoft Sentinel

Query Quota changes

let quotaPattern = @"Daily quota changed to (\d+)";
let previousQuotaPattern = @"Previous quota (\d+)";
let changedByPattern = @"Changed by (.+)";
Operation 
| where Detail startswith "Daily quota"
| extend CurrentQuota = extract(quotaPattern,1,Detail)
| extend PreviousQuota = extract(previousQuotaPattern,1,Detail)
| extend ChangedBy = extract(changedByPattern,1,Detail)

Explanation

This KQL (Kusto Query Language) script is designed to retrieve and analyze information about the ingestion quota configuration for Log Analytics workspaces in Microsoft Sentinel. Here's a simplified breakdown of what each part of the script does:

Retrieve Workspace Configuration:
- The first query fetches details about Log Analytics workspaces, specifically focusing on their ingestion quota settings.
- It filters resources to only include those of the type "microsoft.operationalinsights/workspaces".
- It extracts and displays several key properties:
  - SKUName: The pricing tier of the workspace.
  - dailyQuotaGb: The daily data ingestion limit in gigabytes.
  - quotaNextResetTime: The time when the quota will reset.
  - retentionInDays: The number of days data is retained in the workspace.
- The results are projected to show the workspace name, location, resource group, retention period, SKU name, daily quota, and the next quota reset time.
Track Quota Changes:
- The second query identifies changes to the daily ingestion quota.
- It looks for operations where the detail starts with "Daily quota", indicating a change in the quota.
- It extracts specific information from the operation details:
  - CurrentQuota: The new daily quota value.
  - PreviousQuota: The previous daily quota value before the change.
  - ChangedBy: The user or process that made the change.

Overall, these queries help administrators monitor and manage the data ingestion limits for their Log Analytics workspaces, ensuring they stay within their configured quotas and understand any changes made to these settings.

Details

Alex Verboon

Released: February 26, 2025

Tables

ResourcesOperation

Keywords

SentinelLogAnalyticsResourcesOperationDetailPropertiesQuotaWorkspaceLocationResourceGroupNameSKUNameRetentionInDays

Operators

argResourceswheretypeextendtostringparse_jsontodatetimeprojectletextractstartswith

Actions

GitHub

KQL Search