Merge pull request #287310 from batamig/archive-search

removing outdated images and images we can't replicate in the Defende…

Author: v-regandowner

articles/sentinel/media/restore/restore-azure.png

@@ -3,7 +3,7 @@ title: Restore archived logs from search - Microsoft Sentinel
 description: Learn how to restore archived logs from search job results.
 author: cwatson-cat
 ms.topic: how-to
-ms.date: 03/03/2024
+ms.date: 09/25/2024
 ms.author: cwatson
 appliesto:
     - Microsoft Sentinel in the Azure portal
@@ -15,28 +15,27 @@ ms.collection: usx-security
 
 Restore data from an archived log to use in high performing queries and analytics.
 
-Before you restore data in an archived log, see [Start an investigation by searching large datasets (preview)](investigate-large-datasets.md) and [Restore in Azure Monitor](/azure/azure-monitor/logs/restore).
-
 [!INCLUDE [unified-soc-preview](includes/unified-soc-preview.md)]
 
+## Prerequisites
+
+Before you restore data in an archived log, see [Start an investigation by searching large datasets (preview)](investigate-large-datasets.md) and [Restore in Azure Monitor](/azure/azure-monitor/logs/restore).
+
 ## Restore archived log data
 
-To restore archived log data in Microsoft Sentinel, specify  the table and time range for the data you want to restore. Within a few minutes, the log data is available within the Log Analytics workspace. Then you can use the data in high-performance queries that support full Kusto Query Language (KQL).
+To restore archived log data in Microsoft Sentinel, specify the table and time range for the data you want to restore. Within a few minutes, the log data is available within the Log Analytics workspace. Then you can use the data in high-performance queries that support full Kusto Query Language (KQL).
 
-You can restore archived data directly from the **Search** page or from a saved search.
+Restore archived data directly from the **Search** page or from a saved search.
 
-1. For Microsoft Sentinel in the [Azure portal](https://portal.azure.com), under **General**, select **Search**. <br>For Microsoft Sentinel in the [Defender portal](https://security.microsoft.com/), select **Microsoft Sentinel** > **Search**.
-1. Restore log data in one of two ways:
-   - At the top of **Search** page, select **Restore**.
-      :::image type="content" source="media/restore/search-page-restore.png" alt-text="Screenshot of restore button at the top of the search page.":::
-   - Select the **Saved Searches** tab and **Restore** on the appropriate search.
-     :::image type="content" source="media/restore/search-results-restore.png" alt-text="Screenshot of the restore link on a saved search.":::
+1. In Microsoft Sentinel, select **Search**. In the [Azure portal](https://portal.azure.com), this page is listed under **General**. In the [Defender portal](https://security.microsoft.com/), this page is at the Microsoft Sentinel root level.
 
-1. Select the table you want to restore.
-1. Select the time range of the data that you want restore.
-1. Select **Restore**.
+1. Restore log data using one of the following methods:
 
-   :::image type="content" source="media/restore/restoration-page.png" alt-text="Screenshot of the restoration page with table and time range selected.":::
+   - Select :::image type="icon" source="media/restore/restore-button.png" border="false"::: **Restore** at the top of the page. In the **Restoration** pane on the side, select the table and time range you want to restore, and then select **Restore at the bottom of the pane**.
+
+   - Select **Saved searches**, locate the search results you want to restore, and then select **Restore**. If you have multiple tables, select the one you want to restore and then select **Actions > Restore** in the side pane. For example:
+
+      :::image type="content" source="media/restore/restore-azure.png" alt-text="Screenshot of restoring a specific site search.":::
 
 1. Wait for the log data to be restored. View the status of your restoration job by selecting on the **Restoration** tab.
 
@@ -46,28 +45,23 @@ View the status and results of the log data restore by going to the **Restoratio
 
 1. In Microsoft Sentinel, select **Search** > **Restoration**.
 
-   :::image type="content" source="media/restore/restoration-tab.png" alt-text="Screenshot of the restoration tab on the search page.":::
-
-1. When your restore job is complete, select the table name.
+1. When your restore job is complete and the status is updated, select the table name and review the results.
 
-   :::image type="content" source="media/restore/data-available-select-table.png" alt-text="Screenshot that shows rows with completed restore jobs and a table selected.":::
+   In the [Azure portal](https://portal.azure.com), results are shown in the **Logs** query page. In the [Defender portal](https://security.microsoft.com/), results are shown in the **Advanced hunting** page.
 
-1. Review the results.
+   For example:
 
    :::image type="content" source="media/restore/restored-data-logs-view.png" alt-text="Screenshot that shows the logs query pane with the restored table results.":::
 
-   The Logs query pane shows the name of table containing the restored data. The **Time range** is set to a custom time range that uses the start and end times of the restored data.
+   The **Time range** is set to a custom time range that uses the start and end times of the restored data.
 
 ## Delete restored data tables
 
-To save costs, we recommend you delete the restored table when you no longer need it. When you delete a restored table, Azure doesn't delete the underlying source data.
+To save costs, we recommend you delete the restored table when you no longer need it. When you delete a restored table, the underlying source data isn't deleted.
 
+1. In Microsoft Sentinel, select **Search** > **Restoration** and identify the table you want to delete.
 
-1. In Microsoft Sentinel, select **Search** > **Restoration**.
-1. Identify the table you want to delete.
-1. Select **Delete** for that table row.
-
-   :::image type="content" source="media/restore/delete-restored-table.png" alt-text="Screenshot of restoration tab that shows the delete button on each row.":::
+1. Select **Delete** for that table row to delete the restored table.
 
 ## Next steps