Reducing Microsoft Sentinel Costs Without Compromising Detection – Part 1: The Summary Rules Quest

This blog post explains how to reduce Microsoft Sentinel log storage costs by using Summary Rules together with Auxiliary/Data Lake (and optional split transformations) to store aggregated events in cost-efficient tiers while retaining the ability to perform investigations and alerts via analytic rules; it includes a data-tiers comparison, solution overview (splitting data, creating summary rules, and analytic rules), cost analysis, and contrasts with KQL jobs.