Forum Discussion
Incident Case Data Retention // Incident Case Log Location
Two separate questions for the community.
1. What is the retention period for incident case data? Is it limited to the retention period you have for the associated workspace?
2. I know I can access the incident case data via the "Microsoft.SecurityInsights/cases" resource provider, but is this accessible via Log Analytics directly?
Thank you for the help.
3 Replies
1. It maps to the Table retention
2. Some data is in the SecurityAlert table, more columns are to be added (tbc)
SecurityAlert | summarize count(), last_record = arg_max(TimeGenerated, *) by AlertNameGotcha, so it looks like there is no way to directly access things like incident comments or labels from within Log Analytics, but rather we would need to access the Security Insights resource provider to get the full take data for trending on labels, dashboarding of incidents by assigned analysts, or searching comments etc. by pulling the data into a secondary platform?
What are some of the communities solutions for this? Power BI?
kylemiller061 I have written a blog post about gathering this data in PowerBI here: https://www.garybushey.com/2020/01/20/azure-sentinel-incidents-in-powerbi/
Hope it helps
