In Microsoft Sentinel, the combined analytics and data lake retention period, which can reach 12 years. Keeping data beyond the two-year analytics limit is only possible this way.
Read more: Microsoft Learn
In the Ultra Transcenders books
Each book explains Total retention in context, with comparison tables and the common traps.
Terms in this definition
- Microsoft Sentinel
Microsoft's cloud-native SIEM, with SOAR capabilities, which stores and queries its data in a Log Analytics workspace.
- Data lake
Holds files of every kind, structured, semi-structured or unstructured, usually spread over a distributed file system, and lets engines like Spark apply a schema when reading. In Azure this is Data Lake Storage: Blob Storage with a hierarchical namespace enabled.