Configure interactive and long-term data retention in Microsoft Sentinel

In the previous deployment step, you enabled the User and Entity Behavior Analytics (UEBA) feature to streamline your analysis process. In this article, you learn how to set up interactive and long-term data retention, to make sure your organization retains the data that's important in the long term. This article is part of the Deployment guide for Microsoft Sentinel.

Configure data retention

Retention policies define when to remove data, or mark it for long-term retention, in a Log Analytics workspace. Long-term retention lets you keep older, less used data in your workspace at a reduced cost. To set up data retention plans, consult Log retention plans in Microsoft Sentinel, and use one or both of these methods, depending on your use case:

• Configure interactive and long-term data retention for one or more tables (one table at a time)
• Configure data retention for multiple tables at once

Next steps

In this article, you learned how to set up interactive and long-term data retention.

Perform post-deployment steps