Estimating SIEM costs - specifically Azure Sentinel

I’m trying to provide an estimate for integrating ZIA and ZPA with Azure Sentinel. Does anyone have any metrics for an average user generates “X” Mbs of logs per day? I understand the VM costs, just looking for some estimation of log costs.

How many users do you have?

I was hoping there was an average per user consumption. Let’s 100 users

The average web transactions per user across the cloud is roughly 5000 these days. An uncompressed weblog is roughly 2KB. You can get the actual daily transactions for your tenant from the WebInsights UI in the ZIA admin portal.

Do I take this to mean I should estimate 10Mb of logs per day? 5000 * 2KB?