Question

Your SOC ingests very high volumes of raw network firewall logs into a Microsoft Sentinel workspace. Analysts rarely query the raw records but frequently need aggregated hourly statistics (total bytes, connection counts per source IP) for detections and dashboards, and these aggregates must remain queryable for long periods at low cost. You want to keep the verbose raw data in cheap storage while making the aggregated data readily available for analytics rules. Which approach best meets these requirements?

Accepted Answer

Create a Sentinel summary rule that periodically aggregates the raw table into a custom summary table, and route the raw logs to an Auxiliary/Basic logs plan for low-cost retention.

Answer

Increase the interactive retention on the raw firewall table to the maximum and build workbooks that aggregate the data at query time.

Answer

Configure a DCR ingestion-time transformation that drops all raw firewall records and keeps only aggregated fields in the Analytics table.

Answer

Export the raw firewall table to an Azure Storage account with a diagnostic setting and re-import aggregates manually each month.