Question

You are a SOC analyst using the Microsoft Sentinel data lake tier. You have ingested 18 months of high-volume firewall logs into the data lake for long-term retention. You need to run a scheduled KQL job that aggregates daily outbound traffic by destination IP over the full retention window, and you want the aggregated results to remain queryable by your standard analytics rules and hunting queries with fast, interactive performance. Where must the KQL job write its results to meet this requirement?

Accepted Answer

To a custom table promoted into the analytics tier so results are queryable with interactive performance

Answer

Back into the same data lake tier table where the raw firewall logs reside

Answer

To an Azure Storage account exported via a Logic App playbook

Answer

To a Log Analytics Basic Logs table for cost-optimized retention