Question

Your organization ingests high-volume firewall logs into a Microsoft Sentinel custom table. Compliance requires that these logs remain searchable for interactive queries for 90 days, but must still be retained (available for search jobs and restore) for a total of 2 years to satisfy audit requirements. You want to minimize Log Analytics analytics-tier costs while meeting both requirements. What should you configure?

Accepted Answer

Set the table's interactive retention to 90 days and configure total retention (archive) to 730 days.

Answer

Set the workspace default interactive retention to 730 days for all tables.

Answer

Set the table's interactive retention to 730 days and disable the archive tier.

Answer

Export the table to an Azure Storage account after 90 days using a data export rule, then delete the table data.