Hot data tier of Microsoft Sentinel supporting hunting, detections and every Sentinel feature; its analytics retention can be extended to as much as two years.
Read more: Microsoft Learn
In the Ultra Transcenders books
Each book explains Analytics tier in context, with comparison tables and the common traps.
Terms in this definition
- Hot
The online blob access tier where storing data costs the most but accessing it costs the least.
- Archive
Offline access tier for blobs, cheapest to store yet dearest to access. Reading a blob means rehydrating it first, which can take as long as 15 hours.
- Microsoft Sentinel
Microsoft's cloud-native SIEM, with SOAR capabilities, which stores and queries its data in a Log Analytics workspace.
Related terms
- KQL job
KQL query, run once or on a schedule, against the Microsoft Sentinel data lake, reaching back as far as 12 years; its results can be promoted into the analytics tier.