Question

Your SOC ingests high-volume network flow logs into the Microsoft Sentinel data lake tier. Threat hunters need to run an interactive, ad hoc historical hunt across 90 days of these logs to test a new IOC hypothesis, but the data is not currently in the analytics tier and the hunters want results returned to a notebook session for immediate review without permanently promoting the raw data. Which approach best meets this requirement?

Accepted Answer

Create a KQL job in the data lake to query the historical logs and write results to an output summary table that the hunters can review

Answer

Configure a summary rule to aggregate the network logs on a schedule and hunt against the resulting summary table

Answer

Promote the entire 90 days of network flow logs to the analytics tier and run a scheduled analytics rule against them

Answer

Enable a livestream session on the network logs to monitor incoming events matching the IOC hypothesis