Sentinel – Table Retention

Today we are going to cover how to change an individual tables data retention. I am not the first to write about this, but this is my take on things. I will also be referring to other sites to pull information from and also acknowledge those sites. There are many use cases for this, but enough of that lets get to it.

First we need an ARM template. There are other methods to do this, but I am going to stick with ARM. The following site is the original content creator. I have also created a repository for you to get it from.

Next we need the workbook. The following is the original site. I have also created a repository for you to get it from.

First import the workbook. If you do not know how to do that here is a great article on how-to.

Once you do that the workbook will look like the following

You will notice that you can see the global retention for the Log Analytics Workspace. You will need to select which LA workspace you want to work with.

Under Report Option you can either select Full List or View by Table

I usually pick “View by Table”. If you pick a table that has not been changed it will show like this.

Now lets change the table retention for LinuxAuditLog. its important to know the name as it is in within LA.

Go to Custom Deployment in the Azure Portal

Click on Build your own template in the editor

Now just delete what is in there and copy over the arm template. I always suggest to open up in RAW view and copy it from there.

It will look something like this

Click Save, after you do that, the screen will show this.

Fill out the form. It will look something like this

Click Review and Create, Create. Should look something like this once it is complete.

Now go back into the Saved Workbook and pick the workspace and the table and view the results

This was just one method and a quick how-to. Hope you enjoyed it.

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s