Storage location of Microsoft Sentinel Incidents

Question

Storage location of Microsoft Sentinel Incidents

Anand R Menon 301

Hi Team,

We have a test Microsoft Sentinel environment where we have a data retention period of 30 days. When I check the 'SecurityIncident', 'SecurityAlert' etc. tables, as expected, there is no data present before the 30 day-period. But on the Incidents page, I can see the incidents beyond 30 days listed there. So a bit confused on this. How can the incidents be still visible when the underlying tables are empty for a custom time range? Also will this incur data retention charges? Attaching screenshots related to this. Thank you.

Regards,
Anand R. Menon

1 answer

Your answer

Answer 1

Andrew Blumhardt 10,051 Microsoft Employee

The records are in the SecurityAlert and SecurityIncidents tables. A new record is created with the same ID for every update. The incident dashboard shows the most recent record for each incident.

Rather that using the custom range picker try a full 90 day lookback:

SecurityIncident
| where TimeGenerated > ago(90d)

JamesTran-MSFT 36,911 Reputation points Microsoft Employee Moderator

2022-03-22T18:23:54.977+00:00

@Anand R Menon
I just wanted to check in and see if you had any other questions or if you were able to resolve this issue?
Anand R Menon 301 Reputation points

2022-03-24T09:35:28.927+00:00

@Andrew Blumhardt I tried the below query you mentioned:
SecurityIncident
| where TimeGenerated > ago(90d)

It shows incidents within the past 30 days only which is according to the data retention period set. But on the Incidents page in Sentinel, I can see incidents generated for the past few months. I doubt if its kept temporarily in some alternate tables for a historic purpose. Thank you.
Andrew Blumhardt 10,051 Reputation points Microsoft Employee

2022-03-24T15:59:28.963+00:00

The incident view can review back to when the instance was first created. I was able to look back over a year in my environment. The tables are more of a log it seems.

Sentinel includes 90 days of retention. You can bump that 30 to 90 days.
Anand R Menon 301 Reputation points

2022-03-26T06:56:40.567+00:00

Thanks a lot for the insights. Increased the retention period to 90 days on my workspace. Thank you. :)

Share via

Storage location of Microsoft Sentinel Incidents

1 answer

Your answer