This month Microsoft introduced a data lake for Sentinel, meant to store large amounts of security data at a much lower cost than before. That may sound like a technical detail, but it touches a business question I have written about many times: how much security data can you afford to keep?<\/p>\n
For years the answer has been \u2018not enough\u2019. Logging is expensive, so organisations keep the most important logs for a short time and throw away the rest. Then an incident is discovered months later and the logs that would have shown how the attacker got in are gone.<\/p>\n
With AI the question becomes more important. AI is good at finding patterns in large amounts of data, but only in data that exists. A model can\u00b4t analyse logs you deleted to save money.<\/p>\n
So for management, think of security data as an asset, not just a cost. Keep the high value logs searchable for detection and response. Keep the large volumes in cheaper storage for longer, for investigations and analysis. Decide on retention based on how long it takes to discover an attack, not on the default setting. And make sure the data is good enough to be used: complete, consistent and with known sources.<\/p>\n
The question isn\u00b4t how little data you can get away with. It is how much value you can get from the data you keep.<\/p>\n
You can\u00b4t investigate what you deleted.<\/p>\n","protected":false},"excerpt":{"rendered":"
This month Microsoft introduced a data lake for Sentinel, meant to store large amounts of security data at a much lower cost than before. That may sound like a technical detail, but it touches a business question I have written about many times: how much security data can you afford to keep? For years the […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[11,4],"tags":[38,29,121],"class_list":["post-1481","post","type-post","status-publish","format-standard","hentry","category-business","category-security-architecture","tag-business","tag-logging","tag-microsoft-sentinel"],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1481","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1481"}],"version-history":[{"count":1,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1481\/revisions"}],"predecessor-version":[{"id":1508,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1481\/revisions\/1508"}],"wp:attachment":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1481"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1481"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1481"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}