Question

A threat hunter needs to search 18 months of historical DNS and network logs stored in the Microsoft Sentinel data lake tier to trace a slow-and-low command-and-control beacon. The data is no longer in the analytics tier, and the query is computationally heavy and must run against the full retention window without impacting live analytics performance. Which approach should the hunter use to execute this hunt?

Accepted Answer

Run a KQL job in the Microsoft Sentinel data lake, targeting the lake tier tables and writing results to a new custom table for review

Answer

Create a scheduled analytics rule with a 540-day lookback period so the query covers the full 18 months

Answer

Restore all archived logs back into the analytics tier and run a standard Advanced Hunting query

Answer

Build a Sentinel summary rule that aggregates the DNS data hourly and query the resulting summary table interactively