Blog Post

Microsoft Sentinel Blog
7 MIN READ

A Look at Different Options for Storing and Searching Sentinel Archived Logs

inbalsilis's avatar
inbalsilis
Icon for Microsoft rankMicrosoft
Jan 11, 2023
As an Azure Sentinel user, you may have encountered the need to store and search your log data for extended periods of time. This could be due to regulatory requirements or simply as a means of maint...
Updated Jun 18, 2024
Version 7.0
azure
best practices
siem
solutions
mikhailf's avatar
mikhailf
Steel Contributor
Jan 11, 2023

ADX is a good option to store data ingested by, for example,  Storage Accounts or Kubernetes via Diagnostic Settings. Usually, these services ingest a huge amount of data that is not used by security analysts on a daily basis but can be used to investigate incidents or for compliance.