Sentinel Data Lake Eases Storage of Logs

• Microsoft’s Sentinel Security Information and Event Management (SIEM) includes a new lower-cost data storage tier, Sentinel data lake.
• There is no change to the analytics tier of Sentinel, which is based on Log Analytics.
• Data lake should encourage broader, longer-term retention of logs at a lower cost than Sentinel’s earlier approaches.
• Data lake replaces Sentinel archive logs by enabling retention and search of archived data.

Sentinel now offers a lower-cost data lake tier to encourage high-volume ingestion and long-term retention of log data regardless of source. The data lake tier of log data storage will encourage better log retention—in terms of volume and duration—than Sentinel’s earlier archive tier, while also offering the ability to perform searches at an additional cost. This new storage tier could boost the use of Sentinel for real-time analytics for security and hunting as well as encourage longer-term retention, which is necessary for compliance and auditing.