Defender for Endpoint log retention

Question

Hi there,

In order to increase data retention for CloudAppEvents or DeviceRegistryEvents tables i know we can ingest them in Microsoft Sentinel.

My question is if there is another way to store these logs? I just want to retain the logs for cold storage and ingesting them into Sentinel will have a significant ingestion cost.

Thanks

Answer 1

@Luís Costa

Thank you for reaching out to us.

Yes, there is another way to store the logs from CloudAppEvents or DeviceRegistryEvents tables without ingesting them into Microsoft Sentinel. You can use Microsoft Defender for Endpoint to stream Advanced Hunting events to your Storage account.

Reference: https://learn.microsoft.com/en-us/defender-endpoint/api/raw-data-export-storage

Once the data is stored in your Storage account, you can use Azure Blob Storage lifecycle management to automatically move the data to cold storage after a certain period of time. This can help reduce the cost of storing the data over the long term.

Reference: https://learn.microsoft.com/en-us/azure/storage/blobs/lifecycle-management-overview

Let me know if you have any further questions, feel free to post back.

Please remember to "Accept Answer" if answer helped, so that others in the community facing similar issues can easily find the solution.