Microsoft Security Operations AnalystMitigate threats using Microsoft SentinelHard
A company is implementing Microsoft Sentinel and needs to retain security logs for seven years to meet compliance requirements. They are concerned about the cost of long-term retention. Which storage solution should be used for cost-effective, long-term archiving of Sentinel data beyond the standard interactive retention period?
- AAzure SQL Database
- BArchived logs in Azure Storage (Blob Storage)
- CLog Analytics workspace interactive retention
- DAzure Data Explorer
Show answer & explanationAnswer & explanation
Correct answer: B. Archived logs in Azure Storage (Blob Storage)
For cost-effective, long-term retention of Sentinel data beyond the interactive retention of Log Analytics, archiving logs to Azure Storage (Blob Storage) is the recommended and most economical solution. This allows data to be retained for years at a significantly lower cost.
Why the other options are wrong
- A. Azure SQL Database is a relational database service and is not suitable for storing large volumes of unstructured security logs for long-term, cost-effective archiving.
- C. Log Analytics workspace interactive retention is for active querying and has a maximum of 730 days (2 years), which is insufficient for 7 years and more expensive for long-term archiving.
- D. Azure Data Explorer is a high-performance data analytics service, not primarily designed for cost-effective, cold archiving of security logs.
Microsoft Sentinel Log Archiving
The process of moving older, less frequently accessed security logs from a Log Analytics workspace to a more cost-effective storage solution like Azure Blob Storage for long-term retention.
- Addresses compliance requirements for extended data retention.
- Significantly reduces storage costs compared to Log Analytics interactive retention.
- Archived data can be restored or queried using specific methods if needed.
Memory trick: Think of retention like a library: some books are on the active shelves (Log Analytics), others in deep storage (Blob Archive).