Configure data retention and archive in Microsoft Sentinel

In the previous deployment step, you enabled the User and Entity Behavior Analytics (UEBA) feature to streamline your analysis process. In this article, you learn how to set up data retention and archive, to make sure your organization retains the data that's important in the long term. This article is part of the Deployment guide for Microsoft Sentinel.

Configure data retention and archive

Retention policies define when to remove or archive data in a Log Analytics workspace. Archiving lets you keep older, less used data in your workspace at a reduced cost. To set up data retention, use one or both of these methods, depending on your use case:

• Configure data retention and archive for one or more tables (one table at a time)
• Configure data retention and archive for multiple tables at once

Next steps

In this article, you learned how to set up data retention and archive.

Perform post-deployment steps