Reducing Microsoft Sentinel Costs Without Compromising Detection – Part 2: The Firewall Quest

This blog demonstrates using Microsoft Sentinel Summary Rules to aggregate Windows Filtering Platform firewall traffic into 20-minute summaries (stored in a Data Lake), including KQL parsing examples, ASIM-compatible parser functions, and an analytic rule to detect vertical port scans — aiming to substantially reduce ingestion costs while retaining essential detection and incident response visibility.