Question

Your SOC stores 18 months of raw firewall logs in the Microsoft Sentinel data lake tier to control analytics costs. A threat hunter needs a lightweight, repeatable process that runs every night against the data lake, aggregates outbound connection counts per source IP, and writes the compact results into a custom table that analysts can then query quickly in the analytics tier for daily beaconing hunts. Which approach best meets this requirement?

Accepted Answer

Create a scheduled KQL job in the Sentinel data lake that queries the raw logs on a recurring nightly schedule and outputs aggregated results to a destination table.

Answer

Build a scheduled analytics rule in the analytics tier that queries the data lake tier directly every night and generates incidents.

Answer

Run a one-time on-demand KQL job against the data lake each morning and manually export the results to a CSV for the hunters.

Answer

Configure a Log Analytics table retention archive policy so the aggregated data is automatically produced during the retention rollover.