You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/sentinel/manage-data-overview.md
+2-2Lines changed: 2 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -65,10 +65,10 @@ This table compares the two analytics and data lake tiers and their key characte
65
65
| Ingestion cost | Standard | Minimal |
66
66
| Query price included | ✅ | ❌ |
67
67
| Optimized query performance | ✅ | ❌ Slower queries.<br>Good for auditing. Not optimized for real-time analysis. |
68
-
| Query capabilities |[Full query capabilities](/azure/azure-monitor/logs/get-started-queries) in the Microsoft Defender and Azure portals and using APIs. | - [Full KQL on a single table](/azure/azure-monitor/logs/basic-logs-query), which you can extend with data from an analytics table using [lookup](/azure/data-explorer/kusto/query/lookup-operator).<br>- Run scheduled KQL or Spark jobs.<br>- Use Notebooks. |
68
+
| Query capabilities |[Full query capabilities](/azure/azure-monitor/logs/get-started-queries) in the Microsoft Defender and Azure portals and using APIs. | - [Full query capabilities](/azure/azure-monitor/logs/get-started-queries) including unions and joins.<br>- Run scheduled KQL or Spark jobs.<br>- Use Notebooks. |
69
69
| Full set of real-time analytics features | ✅ | ❌ Limitations on some features, including analytics rules, hunting queries, parsers, watchlists, workbooks, and playbooks. |
|[Summary rules](summary-rules.md)| ✅ | ✅ KQL limited to a single table |
71
+
|[Summary rules](summary-rules.md)| ✅ | ✅ [Full KQL on a single table](/azure/azure-monitor/logs/basic-logs-query), which you can extend with data from an analytics table using [lookup](/azure/data-explorer/kusto/query/lookup-operator)|
| Retention period | 90 days for Microsoft Sentinel, 30 days for Microsoft Defender XDR.<br> Can be extended to up to two years at a prorated monthly long-term retention charge. | Same as analytics retention, by default. Can be extended to up to 12 years. |
0 commit comments