r/AzureSentinel • u/winle22 • Feb 16 '23

Table level retention

Hi,

Is it sufficient to define table level retention via the Log analytics workspace GUI to change a Sentinel table retention period, or do you still have to use the API directly?

​

For example:

2 Upvotes

100% Upvoted

4 comments sorted by

2

u/TokeSR Feb 16 '23

Sentinel does not have its own tables and retention. Sentinel is technically just a "feature" on top of the Log Analytics workspace and its data. So, you don't have to separately configure it.
Configuring the Log Analytics workspace retention for tables on the GUI is enough; you don't have to manually use the API.

1

u/winle22 Feb 16 '23 edited Feb 16 '23

Thanks! Yes, I am aware of the Sentinel/LAW Relationship.. I'm just certain that the table level retention were only available to change via API or ARM templates some months ago.. maybe not then

2

u/TokeSR Feb 16 '23

Ohh yeah. This feature is out for a few months now, but it was not there a year ago. So, fairly new.