Unofficial. Independent community helper — not a Microsoft product, not endorsed by Microsoft. Cost figures are planning estimates from public list pricing; verify Microsoft Sentinel pricing and entitlements with your Microsoft account team. The Microsoft Product Terms and Azure pricing are the source of truth.
Sentinel Optimizer
GitHub

Cut your SIEM bill with clear, private analysis

Paste an export from Microsoft Sentinel, Splunk, or Elastic — or estimate from your infrastructure inventory. See ingestion by source, model your Sentinel cost, and get prioritized savings recommendations. Your raw data never leaves your browser.

● 100% client-side parsing ● Sentinel · Splunk · Elastic ● Cost model + charts ● Optional AI summary
1 · Provide data
// Microsoft Sentinel · Logs (Log Analytics) — run, then Export > JSON
Usage
| where TimeGenerated > ago(30d) and IsBillable == true
| summarize QuantityMB = sum(Quantity) by DataType
| order by QuantityMB desc

Paste the JSON rows from the Usage query (DataType + QuantityMB). Optional: data connectors.

Your pasted data is parsed entirely in your browser and never uploaded.