Forum Discussion

Iron Contributor

Jun 13, 2019

Solved

Sentinel storage is based on Log Analytics? How can we extend past 730 day limit?

Hi All, we have a Customer that requires a retention limit of 3 years and at the moment we seem to be restricted via Log Analytics to a default of 730 days? https://docs.microsoft.com/en-us/azure/az...

Ofer_Shezaf
Jun 16, 2019
David Caddick

The workspace retention cannot be extended beyond 730 days as of now. We are working on a solution to stream data to a colder storage. For now, the available option is to create a program (Azure functions, PowerShell, Logic Apps) that will read the date using the Log Analytics API and send it external storage.

~ Ofer

Ofer_Shezaf

Microsoft

Jun 16, 2019

David Caddick

The workspace retention cannot be extended beyond 730 days as of now. We are working on a solution to stream data to a colder storage. For now, the available option is to create a program (Azure functions, PowerShell, Logic Apps) that will read the date using the Log Analytics API and send it external storage.

~ Ofer

David Caddick

Iron Contributor

Jun 16, 2019

Thanks Ofer_Shezaf

Here in Western Australia we have the local "Office of Auditor General" reviewing local State Govt. departments and insisting that the policy is 3 years, I am assuming it is similar in most states and internationally this is likely to have other policies that are longer than the existing 2 years?
We'll run with 2 Years (730 days) for now and make a determination on that later - can you advise what the best process is to formally request this so this request can be tracked? Should it be simply via a Support request?

Regards,
Dave C