Question

A SOC analyst at a manufacturing company must hunt across 18 months of NetworkSessions logs that were moved to the Microsoft Sentinel data lake tier for cost reasons. The analyst wants to run an ad-hoc KQL investigation over the full historical range but is only occasionally querying this data and does not want to incur the cost of promoting the entire table back into the analytics tier. Which approach in the Microsoft Sentinel platform best meets this requirement?

Accepted Answer

Create a KQL job in the data lake tier that queries the historical NetworkSessions data directly and writes results to a custom output table.

Answer

Promote the NetworkSessions table from the data lake tier back to the analytics tier so it can be queried with standard Advanced Hunting.

Answer

Configure a summary rule to aggregate NetworkSessions and query the resulting summary table in the analytics tier.

Answer

Increase the interactive retention on the analytics tier to 18 months so the full history remains searchable at all times.