Blog Post

Core Infrastructure and Security Blog
9 MIN READ

Archive MDE Data to Event Hubs to ADX

paulberg's avatar
paulberg
Icon for Microsoft rankMicrosoft
Mar 19, 2024
In the lush grass of my backyard, Raven, my miniature Schnauzer, finds her bliss. She lies there, soaking in the sun’s rays, much like the data we export from Defender for Endpoint into Azure Storage...
Updated May 08, 2024
Version 5.0
PaulBergson
stefanpe's avatar
stefanpe
Icon for Microsoft rankMicrosoft
Mar 25, 2024

Hi. While this approach is undoubtedly valid for customers not using Sentinel, it is worth mentioning that customers using Sentinel, after 90 days of free retention, can not only keep the log in the same Analytic tables for up to 2 years but can also store data in the extremely economical Archive Logs tables for up to 12 years. From the archive, Sentinel / Log Analytics allows you to search or even restore data in Analytic tables. This is another - maybe simpler - option available instead of using Azure Storage Accounts and ADX