You are a SOC analyst investigating a slow, low-and-slow data exfiltration campaign that appears to span the past 11 months. The relevant NetworkSession logs have already aged out of the analytics tier (90-day retention) but are still retained in the Microsoft Sentinel data lake tier. You need to run an iterative, complex KQL hunt across the full 11-month history and then, for the small subset of records that match your final hypothesis, make them queryable alongside your near-real-time analytics rules with minimal ongoing cost. Which approach should you use?