Question

A SOC analyst at a financial firm needs to hunt for signs of a slow data-staging campaign over the last 11 months. The relevant firewall logs were moved to the Microsoft Sentinel data lake tier weeks ago and are no longer in the analytics tier. The analyst wants to run an ad-hoc, resource-intensive KQL search across this full historical range without moving all the data back into the analytics tier first. Which approach should the analyst use?

Accepted Answer

Create a KQL job in the Sentinel data lake that queries the data lake tier directly across the 11-month range.

Answer

Run the query in Advanced Hunting in the Defender portal, which automatically spans all data lake retention.

Answer

Configure a scheduled analytics rule with an 11-month lookback window to scan the archived logs.

Answer

Restore the archived table into the analytics tier and query it with a standard Log Analytics KQL query.