Data retention and cost: analytics tier vs Sentinel data lake tier, table plans, summary rules, SOC optimization recommendations

Sentinel is billed mainly on the data you ingest and how long you keep it, so a security operations analyst has to think about cost as well as coverage. Not every log deserves the same treatment. High-value security signals that feed detections, such as sign-in logs, endpoint alerts and identity events, should be fast to query. High-volume, low-value logs, such as verbose firewall, proxy or network flow traffic, are often kept mainly for investigations and compliance. Good design puts each kind of data in the tier that matches how you use it.