Manage Microsoft Sentinel Settings

Unit 6.

Settings for the Microsoft Sentinel Environment are managed in two areas: in Microsoft Sentinel and in the Log Analytics Workspace where Microsoft Sentinel resides. In Microsoft Sentinel, the left navigation pane has a "Settings" option. Most Microsoft Sentinel settings are managed in the Log Analytics Workspace.

Configure Log Retention

Data retention can be configured from 30 to 730 days for all workspaces (unless they are using the legacy Free Pricing tier). To adjust retention: select settings from the Microsoft Sentinel Settings area, select "Usage and estimated costs" tab, and then select "Retention" to open a blade which allows for customisation of retention days.