# Azure Costs Estimates

Installing Anvilogic's UD for Azure creates a new Azure Data Explorer cluster in **your** environment that is used to manage objects to run the Unified Detect framework.

During the set up process, a VM is created that will manage the Data Explorer Cluster.  The default size upon our automated installation of that VM is a **Standard\_E2ads\_v5 (Medium 8vCPUs) in a production cluster with SLA.**  This can be changed at any time if the amount of detections you have running requires more compute resources. 

{% hint style="warning" %}
Review your billing configurations for ADX pricing tiers that control cluster management to ensure proper scaling expectations and configuration for the Anvilogic service to not get terminated. 

See [#estimated-cluster-sizes](#estimated-cluster-sizes "mention") and [#cluster-size-costs](#cluster-size-costs "mention").
{% endhint %}

### Estimated cluster sizes

The table below assumes each deployed job run averages 1 minute and every rule deployed has the specified job run frequency. In reality, you could have a mix of how long the jobs take to run and how often they run. The table below is a guideline to be used for estimating capacity, and is based on the [Azure Data Explorers default concurrency](https://learn.microsoft.com/en-us/kusto/concepts/query-limits?view=microsoft-fabric) limits, which is the number of cores multiplied by 10.

3 Concurrency job runs are reserved for adhoc jobs executed from the Azure TI Builder view when creating or editing a threat identifier. The remaining jobs are reserved for deployed rules.

{% hint style="info" %}
Other KQL queries being run outside of Azure UD also contribute towards this search concurrency and can cause throttled jobs if the cluster is operating near full utilization.
{% endhint %}

<table><thead><tr><th width="219">Cluster size</th><th>Azure ADX concurrency limit</th><th>Job run frequency (in minutes)</th><th>Deployed rules limit</th></tr></thead><tbody><tr><td>Standard_E2ads_v5</td><td>20</td><td>5</td><td>80</td></tr><tr><td>Standard_E2ads_v5</td><td>20</td><td>15</td><td>240</td></tr><tr><td>Standard_E2ads_v5</td><td>20</td><td>30</td><td>480</td></tr><tr><td>Standard_E2ads_v5</td><td>20</td><td>60</td><td>960</td></tr><tr><td>Standard_E4ads_v5</td><td>40</td><td>5</td><td>180</td></tr><tr><td>Standard_E4ads_v5</td><td>40</td><td>15</td><td>540</td></tr><tr><td>Standard_E4ads_v5</td><td>40</td><td>30</td><td>1,080</td></tr><tr><td>Standard_E4ads_v5</td><td>40</td><td>60</td><td>2,160</td></tr><tr><td>Standard_E8ads_v5</td><td>80</td><td>5</td><td>380</td></tr><tr><td>Standard_E8ads_v5</td><td>80</td><td>15</td><td>1,140</td></tr><tr><td>Standard_E8ads_v5</td><td>80</td><td>30</td><td>2,280</td></tr><tr><td>Standard_E8ads_v5</td><td>80</td><td>60</td><td>4,560</td></tr><tr><td>Standard_E16ads_v5</td><td>160</td><td>5</td><td>780</td></tr><tr><td>Standard_E16ads_v5</td><td>160</td><td>15</td><td>2,340</td></tr><tr><td>Standard_E16ads_v5</td><td>160</td><td>30</td><td>4,680</td></tr><tr><td>Standard_E16ads_v5</td><td>160</td><td>60</td><td>9,360</td></tr><tr><td>Standard_D32d_v4</td><td>320</td><td>5</td><td>1,580</td></tr><tr><td>Standard_D32d_v4</td><td>320</td><td>15</td><td>4,740</td></tr><tr><td>Standard_D32d_v4</td><td>320</td><td>30</td><td>9,480</td></tr><tr><td>Standard_D32d_v4</td><td>320</td><td>60</td><td>18,960</td></tr></tbody></table>

### Cluster size costs

The table shows the estimated monthly cost for various cluster sizes.

{% hint style="info" %}
The estimated monthly and annual costs do not include additional storage costs. To determine the additional storage costs, use [Microsoft Azure pricing calculator](https://azure.microsoft.com/en-us/pricing/calculator/) in the Microsoft documentation.&#x20;
{% endhint %}

<table><thead><tr><th width="194.69921875">Cluster size</th><th width="158.38671875">Number of cores</th><th>Estimated monthly cost</th><th>Estimated annual cost</th></tr></thead><tbody><tr><td>Standard_E2ads_v5</td><td>2</td><td>$512 </td><td>$6,144</td></tr><tr><td>Standard_E4ads_v5</td><td>4</td><td>$1,024 </td><td>$12,288</td></tr><tr><td>Standard_E8ads_v5</td><td>8</td><td>$2,050 </td><td>$24,600</td></tr><tr><td>Standard_E16ads_v5</td><td>16</td><td>$4,099 </td><td>$49,188</td></tr><tr><td>Standard_D32d_v4</td><td>32</td><td>$7,781 </td><td>$93,372</td></tr></tbody></table>


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://public-docs.anvilogic.com/get-started/reference-architectures/anvilogic-on-azure/azure-costs-estimates.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.