A security team ingests approximately 2 TB per day into a Log Analytics workspace connected to Microsoft Sentinel. Most of this volume comes from high-volume network firewall and proxy verbose logs that are rarely queried interactively but must be retained for 12 months for occasional forensic investigations and are not used in analytics (scheduled) detection rules. The team wants to reduce ingestion costs while keeping the data available for ad-hoc search and long-term retention. Which approach should you recommend for these specific high-volume tables?