Your SOC ingests a very high volume of firewall verbose traffic logs into Microsoft Sentinel. Analysts only query this data occasionally during investigations, and it is never used in scheduled analytics rules. You must minimize ingestion cost while still allowing analysts to run ad-hoc KQL queries against recent records. Which table plan should you configure for this custom table?