Blog Post

Microsoft Sentinel Blog
7 MIN READ

Export Historical Log Data from Microsoft Sentinel

AmritpalSingh's avatar
AmritpalSingh
Icon for Microsoft rankMicrosoft
May 31, 2022
The need for very large security logs datasets to support complex security analytics and ML is ever-increasing. To facilitate this, security analysts and data scientists need to have the ability to e...
Updated May 31, 2022
Version 1.0
threat hunting
AndrePKI's avatar
AndrePKI
Iron Contributor
Feb 01, 2024

@AmritpalSingh  I believe this solution is subject to the Log Analytics Query API limits w.r.t. result set size? I.e. 64 MB in total, or 500.000 rows, whichever is smaller?

Could you please confirm?
Are there any metrics about speed? For example, we reach 64 MB for 1.5 minutes of data in one table, and we have to export about 1.5 years of data.  Then we have some 50 tables more, as well....