EventID by _BilledSize.kql

// Author: Ian D. Hanley | LinkedIn: /in/ianhanley/ | Twitter: @IanDHanley | Github: https://github.com/EEN421 | Blog: Hanley.cloud / DevSecOpsDad.com
//Return the ingest volume in GB for a given EventID from the SecurityEvent table

SecurityEvent		             		        //<-- Query the SecurityEvent table
| where TimeGenerated > ago(1h)		            	//<-- Query the last hour
| where EventID == 8002			                //<-- Query for EventID 8002
| summarize GB=sum(_BilledSize)/1000/1000/1000	        //<-- Summarize billable volume in GB

//You can change the last line in the above query to the following if you’re a stickler for Gibibytes versus Gigabytes: 

| summarize GB=sum(_BilledSize)/1024/1024/1024