Explore Our Microsoft Cloud Security Training →
Introduction
The Difference
Log Analytics is the primary tier for real-time analysis, alerting, and visualization. It’s designed for high-frequency logs and queries with short retention periods.
Sentinel Data Lake, on the other hand, is a cost-effective storage solution for infrequently accessed logs requiring long-term retention.
Log Types
High-frequency logs such as security alerts, system events, and application logs belong in Log Analytics. Low-frequency logs like audit logs, network traffic data, and IoT device telemetry are best suited for the Data Lake.
Cost Implications
Ingesting all logs into Log Analytics can lead to high costs due to the per GB/month charge for each log type. Moving low-frequency logs to the Data Lake reduces these costs.
Configuring Data Tiering Policies
You can configure data tiering policies in Sentinel to automatically move infrequently accessed logs from Log Analytics to the Data Lake based on query frequency and retention needs.
Querying Data Lake Logs via KQL Jobs
Periodic queries on the Data Lake can be performed using KQL jobs, which run at specified intervals, allowing you to extract insights from your low-frequency logs without incurring excessive costs.
Conclusion
To optimize Sentinel costs, classify your logs by query frequency and retention needs. Move low-frequency logs to the Data Lake tier and use KQL jobs for periodic data lake queries. This approach ensures that you have access to the logs you need while keeping costs under control.
Explore Microsoft Cloud Security Training to master Sentinel and other essential cloud security solutions.
Explore Our Microsoft Cloud Security Training →
Written by Mohammed Akhter
Founder of ITP Training. 50,000+ students trained across 30+ countries in Microsoft endpoint and cloud security. Learn more →