POC: Sette opp Sentinel i egen subscription

[Herskis]

### Tasks
- [x] Opprette subscription Altinn-Sentinel-Prod
- [x] Sette opp eget law og tilknytte ny sentinel
- [x] sette opp connectorer
- [x] Logging fra tjenesteeier subscription
- [x] AppRequests
- [x] AppDependencies
- [x] AppTraces
- [x] ApiManagementGatewayLogs
- [x] Perf

[ootneim]

@Herskis Tabellene:

• AppRequest
• AppDependencies
• AppTraces
• AppExeptions
• AppEvents
• AppPageViews
• AppAvailabilityResults

Kommer fra Applicatoion Inslight som lagrer data i dette workspace.

Her er en spørring som viser hvor mye som er lagret i tabellene siste 30 dager:

let pricePerGB_NOK = 28.7; // Prisen per GB i NOK
let totalIngestedGB = toscalar(
    Usage
    | where TimeGenerated > startofday(ago(30d))
    | where IsBillable == true
    | where DataType in ('AppRequests', 'AppDependencies', 'AppTraces', 'AppExceptions', 'AppEvents', 'AppMetrics', 'AppPageViews', 'AppAvailabilityResults')
    | summarize TotalIngestedGB = sum(Quantity) / 1000
);
Usage
| where TimeGenerated > startofday(ago(30d))
| where IsBillable == true
| where DataType in ('AppRequests', 'AppDependencies', 'AppTraces', 'AppExceptions', 'AppEvents', 'AppMetrics', 'AppPageViews', 'AppAvailabilityResults')
| summarize IngestedGB = sum(Quantity) / 1000 by DataType
| extend PricePerTable_NOK = round(IngestedGB * pricePerGB_NOK, 2)
| extend Percentage = IngestedGB * 100.0 / totalIngestedGB
| project DataType, IngestedGB = round(IngestedGB, 2), Percentage = round(Percentage, 2), PricePerTable_NOK
| union (
    Usage
    | where TimeGenerated > startofday(ago(30d))
    | where IsBillable == true
    | where DataType in ('AppRequests', 'AppDependencies', 'AppTraces', 'AppExceptions', 'AppEvents', 'AppMetrics', 'AppPageViews', 'AppAvailabilityResults')
    | summarize IngestedGB = sum(Quantity) / 1000
    | extend DataType = "Total"
    | extend Percentage = 100.0
    | project DataType, IngestedGB = round(IngestedGB, 2), Percentage, PricePerTable_NOK = round(IngestedGB * pricePerGB_NOK, 2)
)

[ootneim]

@Herskis

Her er en spørring for å vise hvilke ressurser som har logget mest siste 30 dager til Log Analytic Workspace.

Etter Application Insight er det AKS clustre som logger mest.

union *
| where TimeGenerated >= ago(30d)
| summarize LoggingCount = count() by TableName, _ResourceId
| extend ResourceName = tostring(split(_ResourceId, '/')[8])
| project TableName, ResourceName, LoggingCount
| order by LoggingCount desc

Output:

[Herskis]

POC has been upgraded to solution