Skip to content

Commit 9d14e1b

Browse files
committed
wip
1 parent 4aa2980 commit 9d14e1b

File tree

4 files changed

+34
-5
lines changed

4 files changed

+34
-5
lines changed

articles/sentinel/graph/sentinel-lake-connectors.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,7 @@ To configure retention and tiering for the data connector see [Configure data co
3333

3434
## Microsoft Sentinel XDR data
3535

36-
All tables from your Microsoft Sentinel XDR connector are enabled in the data lake with 30-day retention period. Navigate to **System** > **Data Management** > **Table management** in the Microsoft Defender portal to extend retention of the XDR tables without impacting the default retention of your analytics tier tables.
36+
All tables from your Microsoft Sentinel XDR connector are enabled in the data lake with 30-day retention period. Navigate to **Microsoft Sentinel** > **Configuration** > **Tables** in the Microsoft Defender portal to extend retention of the XDR tables without impacting the default retention of your analytics tier tables.
3737

3838
Non-DCR/MMA-based custom tables aren't mirrored to the data lake. DCR-based custom tables are mirrored.
3939

articles/sentinel/graph/sentinel-lake-onboarding.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -93,7 +93,7 @@ Use the following steps to onboard to the Microsoft Sentinel data lake from the
9393
:::image type="content" source="./media/sentinel-lake-onboarding/onboarding-banner.png" lightbox="./media/sentinel-lake-onboarding/onboarding-banner.png" alt-text="A screenshot showing the Defender portal home page with the onboarding banner for Microsoft Sentinel data lake.":::
9494

9595
> [!NOTE]
96-
> If you accidentally close the banner, you can initiate onboarding by navigating to the data lake settings page under **System** > **Settings** > **Microsoft Sentinel** > **data lake**.
96+
> If you accidentally close the banner, you can initiate onboarding by navigating to the data lake settings page under **System** > **Settings** > **Microsoft Sentinel** > **Data lake**.
9797
9898

9999
1. If you don't have the correct roles to set up the data lake, a side panel appears indicating that you don't have the required permissions. Request that your administrator completes the onboarding process.

articles/sentinel/manage-table-tiers-retention.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,7 @@ For more information about Microsoft Sentinel workspace permissions, see [Roles
3838

3939
To view and manage table settings in the Microsoft Defender portal:
4040

41-
1. Select **System** > **Data management** > **Table management** from the left navigation pane.
41+
1. Select **Microsoft Sentinel** > **Configuration** > **Tables** from the left navigation pane.
4242

4343
The **Table** screen lists all the tables you can manage in the Microsoft Defender portal and the settings of each table.
4444

articles/sentinel/whats-new.md

Lines changed: 31 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,8 @@ The listed features were released in the last six months. For information about
2121
## July 2025
2222

2323
- [Microsoft Sentinel data lake (preview) ](#microsoft-sentinel-data-lake-preview)
24+
- [Table management and retention settings in the Microsoft Defender portal](#table-management-and-retention-settings-in-the-microsoft-defender-portal)
25+
- [Microsoft Sentinel data lake permissions integrated with Microsoft Defender XDR unified RBAC (Preview)](#microsoft-sentinel-data-lake-permissions-integrated-with-microsoft-defender-xdr-unified-rbac-preview)
2426
- [No limit on the number of workspaces you can onboard to the Defender portal](#no-limit-on-the-number-of-workspaces-you-can-onboard-to-the-defender-portal)
2527
- [Microsoft Sentinel in the Azure portal to be retired July 2026](#microsoft-sentinel-in-the-azure-portal-to-be-retired-july-2026)
2628

@@ -33,10 +35,37 @@ Key benefits of the Microsoft Sentinel data lake include:
3335
+ Separation of storage and compute for greater flexibility
3436
+ Support for multiple analytics engines to unlock deeper insights from your security data
3537
+ Native integration with Microsoft Sentinel, including the ability to select tiering for log data across analytics and lake tiers
38+
For more information, see
3639

37-
Explore the data lake using KQL queries, or use the new Microsoft Sentinel data lake notebook for VS Code to visualize and analyze your data. For more information, see [Microsoft Sentinel data lake]( graph/sentinel-lake-overview.md).
40+
Explore the data lake using KQL queries, or use the new Microsoft Sentinel data lake notebook for VS Code to visualize and analyze your data.
41+
42+
For more information, see:
43+
44+
- [Microsoft Sentinel data lake]( graph/sentinel-lake-overview.md)
45+
- [KQL and the Microsoft Sentinel data lake (preview)](graph/kql-overview.md)
46+
- [Jupyter notebooks and the Microsoft Sentinel data lake (preview)](graph/notebooks-overview.md)
47+
- [Data lake tech blog](https://aka.ms/datalaketechblog)
48+
49+
### Table management and retention settings in the Microsoft Defender portal
50+
51+
Table management and retention settings are now available in the Microsoft Defender portals. You can view and manage table settings in the Microsoft Defender portal, including retention settings for Microsoft Sentinel and Defender XDR tables, and switch between analytics and data lake tiers.
52+
53+
For more information, see:
54+
+ [Manage data tiers and retention in Microsoft Sentinel (preview)](manage-data-overview.md)
55+
+ [Configure table settings in Microsoft Sentinel (preview)](manage-table-tiers-retention.md).
56+
57+
58+
### Microsoft Sentinel data lake permissions integrated with Microsoft Defender XDR unified RBAC (preview)
59+
60+
Starting in July 2025, Microsoft Sentinel data lake permissions are provided through Microsoft Defender XDR unified RBAC. Support for unified RBAC is available in addition the support provided by global Microsoft Entra ID roles.
61+
62+
For more information, see:
63+
64+
- [Microsoft Defender XDR Unified role-based access control (RBAC)](/defender-xdr/manage-rbac)
65+
- [Create custom roles with Microsoft Defender XDR Unified RBAC](/defender-xdr/create-custom-rbac-roles)
66+
- [Permissions in Microsoft Defender XDR Unified role-based access control (RBAC)](/defender-xdr/custom-permissions-details)
67+
- [Roles and permissions for the Microsoft Sentinel data lake (Preview)](/azure/sentinel/roles#roles-and-permissions-for-the-microsoft-sentinel-data-lake-preview)
3868

39-
Learn more at [Data lake tech blog](https://aka.ms/datalaketechblog).
4069

4170
### No limit on the number of workspaces you can onboard to the Defender portal
4271

0 commit comments

Comments
 (0)