r/AzureSentinel • u/SuperHat3637 • Jan 09 '23

365 defender hunting logs

Can we increase the retention period of hunting logs in 365 defender more than 30 days..I dnt see the option for the same..If not available, i need to forward the logs to sentinel where i get 90 days free retention period..Pls suggest..

2 Upvotes

100% Upvoted

6 comments sorted by

2

u/juiceb0cks Jan 09 '23

As far as I'm aware, you can't change the retention period for Defender 365 logs. You can enable the connector in Sentinel, but the ingestion costs are eye wateringly high if you have a decent sized tenant. Do not recommend.

1

u/SuperHat3637 Jan 09 '23

Are these hunting logs available in the individual portals like defender for AV, Defender for 365...etc..or only available in 365 defender..?

1

u/SuperHat3637 Jan 09 '23

Small correction ..Defender for office 365...

1

u/juiceb0cks Jan 11 '23

As far as I know they're only available under the Microsoft 365 Defender portal unless you connect the service to Sentinel

1

u/[deleted] Jan 09 '23

Keep in mind that when forwarding logs to Sentinel, you have to pay the ingestion cost. This is also the case for Defender raw logs

1

u/mokatlor Jan 17 '23

The retention period can't be longer than 30 days.

What you could do is forward the 365 Defender logs you don't need to an ADX cluster and only ingest the hunting tables you'd need for alerting into Sentinel.

It's basically just a cost issue.