🔥 3-day streak
Microsoft Security Operations Analyst149 / 190
Question 149 of 190

Your SOC ingests firewall logs into a custom table in Microsoft Sentinel. Compliance requires that these logs remain queryable with full KQL and interactive search for 180 days, but the data is rarely accessed after 90 days. The team wants to minimize cost while meeting the compliance requirement. In the Log Analytics workspace, the table's interactive retention is currently set to 90 days and total retention to 90 days. What should you configure?

Reviewed for accuracy · Report an issueNext question