You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/sentinel/graph/sentinel-lake-connectors.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -33,7 +33,7 @@ To configure retention and tiering for the data connector see [Configure data co
33
33
34
34
## Microsoft Sentinel XDR data
35
35
36
-
All tables from your Microsoft Sentinel XDR connector are enabled in the data lake with 30-day retention period. Navigate to **System** > **Data Management** > **Table management** in the Microsoft Defender portal to extend retention of the XDR tables without impacting the default retention of your analytics tier tables.
36
+
All tables from your Microsoft Sentinel XDR connector are enabled in the data lake with 30-day retention period. Navigate to **Microsoft Sentinel** > **Configuration** > **Tables** in the Microsoft Defender portal to extend retention of the XDR tables without impacting the default retention of your analytics tier tables.
37
37
38
38
Non-DCR/MMA-based custom tables aren't mirrored to the data lake. DCR-based custom tables are mirrored.
Copy file name to clipboardExpand all lines: articles/sentinel/graph/sentinel-lake-onboarding.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -93,7 +93,7 @@ Use the following steps to onboard to the Microsoft Sentinel data lake from the
93
93
:::image type="content" source="./media/sentinel-lake-onboarding/onboarding-banner.png" lightbox="./media/sentinel-lake-onboarding/onboarding-banner.png" alt-text="A screenshot showing the Defender portal home page with the onboarding banner for Microsoft Sentinel data lake.":::
94
94
95
95
> [!NOTE]
96
-
> If you accidentally close the banner, you can initiate onboarding by navigating to the data lake settings page under **System** > **Settings** > **Microsoft Sentinel** > **data lake**.
96
+
> If you accidentally close the banner, you can initiate onboarding by navigating to the data lake settings page under **System** > **Settings** > **Microsoft Sentinel** > **Data lake**.
97
97
98
98
99
99
1. If you don't have the correct roles to set up the data lake, a side panel appears indicating that you don't have the required permissions. Request that your administrator completes the onboarding process.
Copy file name to clipboardExpand all lines: articles/sentinel/whats-new.md
+31-2Lines changed: 31 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -21,6 +21,8 @@ The listed features were released in the last six months. For information about
21
21
## July 2025
22
22
23
23
-[Microsoft Sentinel data lake (preview) ](#microsoft-sentinel-data-lake-preview)
24
+
-[Table management and retention settings in the Microsoft Defender portal](#table-management-and-retention-settings-in-the-microsoft-defender-portal)
25
+
-[Microsoft Sentinel data lake permissions integrated with Microsoft Defender XDR unified RBAC (Preview)](#microsoft-sentinel-data-lake-permissions-integrated-with-microsoft-defender-xdr-unified-rbac-preview)
24
26
-[No limit on the number of workspaces you can onboard to the Defender portal](#no-limit-on-the-number-of-workspaces-you-can-onboard-to-the-defender-portal)
25
27
-[Microsoft Sentinel in the Azure portal to be retired July 2026](#microsoft-sentinel-in-the-azure-portal-to-be-retired-july-2026)
26
28
@@ -33,10 +35,37 @@ Key benefits of the Microsoft Sentinel data lake include:
33
35
+ Separation of storage and compute for greater flexibility
34
36
+ Support for multiple analytics engines to unlock deeper insights from your security data
35
37
+ Native integration with Microsoft Sentinel, including the ability to select tiering for log data across analytics and lake tiers
38
+
For more information, see
36
39
37
-
Explore the data lake using KQL queries, or use the new Microsoft Sentinel data lake notebook for VS Code to visualize and analyze your data. For more information, see [Microsoft Sentinel data lake](graph/sentinel-lake-overview.md).
40
+
Explore the data lake using KQL queries, or use the new Microsoft Sentinel data lake notebook for VS Code to visualize and analyze your data.
41
+
42
+
For more information, see:
43
+
44
+
-[Microsoft Sentinel data lake](graph/sentinel-lake-overview.md)
45
+
-[KQL and the Microsoft Sentinel data lake (preview)](graph/kql-overview.md)
46
+
-[Jupyter notebooks and the Microsoft Sentinel data lake (preview)](graph/notebooks-overview.md)
47
+
-[Data lake tech blog](https://aka.ms/datalaketechblog)
48
+
49
+
### Table management and retention settings in the Microsoft Defender portal
50
+
51
+
Table management and retention settings are now available in the Microsoft Defender portals. You can view and manage table settings in the Microsoft Defender portal, including retention settings for Microsoft Sentinel and Defender XDR tables, and switch between analytics and data lake tiers.
52
+
53
+
For more information, see:
54
+
+[Manage data tiers and retention in Microsoft Sentinel (preview)](manage-data-overview.md)
55
+
+[Configure table settings in Microsoft Sentinel (preview)](manage-table-tiers-retention.md).
56
+
57
+
58
+
### Microsoft Sentinel data lake permissions integrated with Microsoft Defender XDR unified RBAC (preview)
59
+
60
+
Starting in July 2025, Microsoft Sentinel data lake permissions are provided through Microsoft Defender XDR unified RBAC. Support for unified RBAC is available in addition the support provided by global Microsoft Entra ID roles.
61
+
62
+
For more information, see:
63
+
64
+
-[Microsoft Defender XDR Unified role-based access control (RBAC)](/defender-xdr/manage-rbac)
65
+
-[Create custom roles with Microsoft Defender XDR Unified RBAC](/defender-xdr/create-custom-rbac-roles)
66
+
-[Permissions in Microsoft Defender XDR Unified role-based access control (RBAC)](/defender-xdr/custom-permissions-details)
67
+
-[Roles and permissions for the Microsoft Sentinel data lake (Preview)](/azure/sentinel/roles#roles-and-permissions-for-the-microsoft-sentinel-data-lake-preview)
38
68
39
-
Learn more at [Data lake tech blog](https://aka.ms/datalaketechblog).
40
69
41
70
### No limit on the number of workspaces you can onboard to the Defender portal
0 commit comments