Defender's 90-day raw data retention is great for forensics, but the Log Analytics costs can explode if you're not careful. The default config pulls in everything. You need to be surgical.
First, audit your current ingestion. Run a query to see top data types:
```
union withsource=_TableName *
| where TimeGenerated > ago(30d)
| summarize DataVolumeGB = sum(_BilledSize) / 1024 / 1024 / 1024 by _TableName
| top 10 by DataVolumeGB desc
```
Common culprits are `DeviceNetworkEvents`, `DeviceFileEvents`, and `DeviceProcessEvents`.
Then, implement a custom ingestion filter via PowerShell or ARM. Target noisy, low-value events. Example rule to drop common Windows service noise:
```
{
"description": "Filter out svchost typical spawning",
"query": "ActionType == 'ProcessCreated' and InitiatingProcessFileName =~ 'svchost.exe' and FileName in~ ('conhost.exe', 'WerFault.exe')"
}
```
Also, reduce the default 90 days. For non-critical tables, set a shorter retention policy (e.g., 30 days) directly in the workspace. Balance cost with compliance needs.