Hi everyone, I'm pretty new to managing security data at this scale and I'm trying to wrap my head around our Sentinel setup. Our Log Analytics workspace is growing really fast and costs are starting to creep up. I've read that archiving older logs to a cheaper cold storage is a common practice, but I'm getting confused on the actual *how*.
My main goal is to move data older than, say, 90 days out of the hot Sentinel/Log Analytics tier to something like Azure Blob Storage (cool tier) or Azure Data Lake. But here's my sticking point: how do I handle the occasional need to query that archived data? If there's an investigation that needs to look back six months, I don't want it to be a huge manual ordeal to get those logs back.
I've seen mentions of using Logic Apps or Azure Functions with the REST API for the export part, but the overall workflow seems complex. And then for querying, would I need to build a separate process to pull data back into Log Analytics temporarily, or can I query it directly from Blob Storage somehow? I'm also wondering if there's a role for Azure Data Explorer or even BigQuery (we use GCP for some things) in this pattern.
Could anyone share a basic, real-world flow they use? I'm eager to learn but feeling a bit overwhelmed by all the moving Azure pieces 😅. What are the key steps and the main tools I should be focusing on?