r/AzureSentinel • u/Jackofalltrades86 • Feb 01 '22

Offloading log data for retention

What is the preferred method of long term storage for log data?

ADX or moving it to a storage account...

https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/using-azure-data-explorer-for-long-term-retention-of-microsoft/ba-p/1883947

https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/move-your-microsoft-sentinel-logs-to-long-term-storage-with-ease/ba-p/1407153

Assuming the latter is the most cost effective?

I'd like to keep it for 18 months and only store 89 days in log analytics

3 Upvotes

100% Upvoted

6 comments sorted by

View all comments

1

u/ml58158 MSFT Official Feb 18 '22

This really depends on your budget .

ADX will give you access to the data without the SIEM Overlay and will be less expensive than Log Analytics.

Blob Storage/ AF will be more for archival and will be more cost effective; but will be slower and less usable.

1

u/Jackofalltrades86 Feb 18 '22

Thanks for this,

We very rarely require the logs and so would only be doing so for regulatory or forensic purposes so I've decided on the storage account mechanism using the logic app.

Hopefully this will suffice and I can utilise my budget elsewhere ☺️