Skip to content

Commit f93b1fa

Browse files
authored
Update investigate-large-datasets.md
I replaced analytics with deeper analysis. I think you meant analytics as in analysis, and not analytics rules. Analytics only support looking back on 14 days, so it is not true that you can use Restore to run analytics rules. I would change the wording to avoid confusing because initially I thought this referred to analytics rules.
1 parent a9602d8 commit f93b1fa

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

articles/sentinel/investigate-large-datasets.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ ms.author: cwatson
1111

1212
One of the primary activities of a security team is to search logs for specific events. For example, you might search logs for the activities of a specific user within a given time-frame.
1313

14-
In Microsoft Sentinel, you can search across long time periods in extremely large datasets by using a search job. While you can run a search job on any type of log, search jobs are ideally suited to search archived logs. If you need to do a full investigation on archived data, you can restore that data into the hot cache to run high performing queries and analytics.
14+
In Microsoft Sentinel, you can search across long time periods in extremely large datasets by using a search job. While you can run a search job on any type of log, search jobs are ideally suited to search archived logs. If you need to do a full investigation on archived data, you can restore that data into the hot cache to run high performing queries and deeper analysis.
1515

1616
> [!IMPORTANT]
1717
> The search job and restore features are currently in **PREVIEW**. The [Azure Preview Supplemental Terms](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) include additional legal terms that apply to Azure features that are in beta, preview, or otherwise not yet released into general availability.

0 commit comments

Comments
 (0)