Sentinel Data Storage and Audit Log Querying for Compliance

Managing massive volumes of security data requires a strategic approach to storage costs and compliance. This text-based course provides a clear pathway to understanding how data is ingested, stored, and analyzed within Sentinel. You will learn how to structure log tables, optimize storage using different retention tiers, and perform compliance-focused investigations. By the end of this course, you will be ready to connect critical audit sources and query logs to trace activities across your environment. What you'll learn: - Understand foundational security logging terminology and Sentinel storage architecture - Configure custom log tables and manage data retention, basic tiers, and archive policies - Connect Purview Audit data to centralize your compliance and security monitoring - Query audit logs within the Defender XDR portal to investigate potential incidents - Apply modern cost-optimization strategies for long-term security data storage The course starts with key security concepts and storage definitions before guiding you through practical configuration steps. You will then read through real-world query scenarios to build confidence in analyzing audit data. This course is designed for beginner security analysts, compliance administrators, and IT professionals new to cloud security operations. No prior experience with Sentinel is required. Begin reading now to build a solid foundation in security data management and compliance auditing.