|
1 | 1 | ---
|
2 |
| -title: Configure data retention for a table in Microsoft Sentinel and Azure Monitor |
3 |
| -description: Set a retention policy for a table in a Log Analytics workspace. |
| 2 | +title: Configure data retention for logs in Microsoft Sentinel or Azure Monitor |
| 3 | +description: In this tutorial, you'll configure an archive policy for a table in a Log Analytics workspace. |
4 | 4 | author: cwatson-cat
|
5 | 5 | ms.author: cwatson
|
6 | 6 | ms.service: microsoft-sentinel
|
7 | 7 | ms.topic: tutorial
|
8 |
| -ms.date: 09/02/2-22 |
| 8 | +ms.date: 09/23/2022 |
9 | 9 | ms.custom: template-tutorial
|
| 10 | +#Customer intent: As an Azure account administrator, I want to archive older but less used data to save retention costs. |
10 | 11 | ---
|
11 | 12 |
|
12 | 13 | # Tutorial: Configure a data retention policy for a table in a Log Analytics workspace
|
13 | 14 |
|
14 |
| -<!-- 2. Introductory paragraph |
15 |
| -Required. Lead with a light intro that describes, in customer-friendly language, |
16 |
| -what the customer will learn, or do, or accomplish. Answer the fundamental “why |
17 |
| -would I want to do this?” question. Keep it short. |
18 |
| ---> |
| 15 | +In this tutorial, you'll set a retention policy for a table in your Log Analytics workspace that you use for Microsoft Sentinel or Azure Monitor. These steps allow you to keep older, less used data in your workspace at a reduced cost. |
19 | 16 |
|
20 |
| -[Add your introductory paragraph] |
21 |
| - |
22 |
| -<!-- 3. Tutorial outline |
23 |
| -Required. Use the format provided in the list below. |
24 |
| ---> |
| 17 | +Retention policies in a Log Analytics workspace define when to remove or archive data in the workspace. By default, all tables in your workspace inherit the workspace's interactive retention setting and have no archive policy. You can modify the retention and archive policies of individual tables, except for workspaces in the legacy Free Trial pricing tier. |
25 | 18 |
|
26 | 19 | In this tutorial, you learn how to:
|
27 | 20 |
|
28 | 21 | > [!div class="checklist"]
|
29 | 22 | > * Set the retention policy for a table
|
30 |
| -
|
31 |
| - |
32 |
| -<!-- 4. Prerequisites |
33 |
| -Required. First prerequisite is a link to a free trial account if one exists. If there |
34 |
| -are no prerequisites, state that no prerequisites are needed for this tutorial. |
35 |
| ---> |
| 23 | +> * Review data retention and archive policy |
36 | 24 |
|
37 | 25 | ## Prerequisites
|
38 | 26 |
|
39 |
| -- <!-- An Azure account with an active subscription. [Create an account for free] |
40 |
| - (https://azure.microsoft.com/free/?WT.mc_id=A261C142F). --> |
41 |
| -- <!-- prerequisite 2 --> |
42 |
| -- <!-- prerequisite n --> |
43 | 27 |
|
44 |
| -<!-- 5. H2s |
45 |
| -Required. Give each H2 a heading that sets expectations for the content that follows. |
46 |
| -Follow the H2 headings with a sentence about how the section contributes to the whole. |
47 |
| ---> |
48 | 28 | To complete the steps in this tutorial, you must have the following resources and roles.
|
49 | 29 |
|
| 30 | +- Azure account with an active subscription. [Create an account for free](https://azure.microsoft.com/free/?WT.mc_id=A261C142F). |
| 31 | + |
| 32 | +- Azure account with the following roles: |
| 33 | + |
| 34 | + |Built-in Role |Scope |Reason | |
| 35 | + |---------|---------|---------| |
| 36 | + |[Log Analytics Contributor ](/azure/role-based-access-control/built-in-roles) |- Subscription and/or </br>- Resource group and/or</br>- Table | To set retention policy on tables in Log Analytics | |
50 | 37 | - Log Analytics workspace.
|
51 | 38 |
|
52 | 39 | ## Set the retention policy for a table
|
53 | 40 | <!-- Introduction paragraph -->
|
54 | 41 |
|
55 | 42 | 1. Sign in to the [Azure portal](https://portal.azure.com).
|
56 |
| -1. In the Azure portal, search for and open **Log Analytics workspaces". |
| 43 | +1. In the Azure portal, search for and open **Log Analytics workspaces**. |
57 | 44 | 1. Select the appropriate workspace.
|
58 | 45 | 1. Under **Settings**, select **Tables**.
|
59 | 46 | 1. On a table like **Syslog**, open the context menu (...).
|
@@ -88,4 +75,4 @@ No resources were created but you might want to restore the data retention setti
|
88 | 75 | ## Next steps
|
89 | 76 |
|
90 | 77 | > [!div class="nextstepaction"]
|
91 |
| -> [Data collection rules in Azure Monitor](/azure/azure-monitor/essentials/data-collection-rule-overview) |
| 78 | +> [Configure data retention and archive policies in Azure Monitor Logs](/azure/azure-monitor/logs/data-retention-archive?tabs=portal-1%2Cportal-2) |
0 commit comments