Sentinel – View Table Retention via Workbook

Today we are going to cover how to view an individual tables data retention. I am not the first to write about this, but this is my take on things. I will also be referring to other sites to pull information from and also acknowledge those sites. There are many use cases for this, but enough of that lets get to it.

First we need the workbook. The following is the original site. I have also created a repository for you to get it from.

Import the workbook. If you do not know how to do that here is a great article on how-to.

Once you do that the workbook will look like the following

You will notice that you can see the global retention for the Log Analytics Workspace. You will need to select which LA workspace you want to work with.

Under Report Option you can either select Full List or View by Table

I usually pick “View by Table”. If you pick a table that has not been changed it will show like this.

Just a quick how-to. Hope you enjoyed it.

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s