Skip to main content
Solved

Long-term retention strategies for M365 logs with Cribl and Sentinel

  • Nov 4, 2026 11:54 AM UTC
  • 1 reply
  • 0 views
This message originated from Cribl Community Slack.
Click here to view the original link.

Hi all, I am wondering what everyone's strategy is for long term retention of M365 logs when Sentinel is being used as the SIEM. Do you keep M365 logs long-term in Sentinel Data Lake and use Cribl Search to access them, or pull logs into Cribl through Microsoft's API's and store them long term in Cribl Lake, or something else? Any major pros or cons that would help steer a guy in the right direction?

Best answer by willheinemansraio

We recommend sending to ADX which ends up being cheaper and easier to maintain in the long term than SDL.
View original

1 reply

We recommend sending to ADX which ends up being cheaper and easier to maintain in the long term than SDL.
Terms & ConditionsAccessibility statement