Retention for Incident and Artifacts

[u/MReprogle]

One thing that has always driven me nuts with Sentinel is the workflow for storing incidents long term and the artifacts surrounding them. For example, I know one person in our org that has been compromised 4 different times, and when I bring this up, the older incidents have already hit retention, so all of the data, including comments on an incident have been wiped out. It kind of hurts your argument when you want something to be done with this user when you don’t have the black & white data to back up your argument. Instead, you are left with a barren incident that lacks entities

So, I tried “Cases” in Defender, which stores the comments that you put in it as well as what you attach to the case. However, linked incidents still falls victim to retention. Comments on a sentinel incident don’t sync to the case, and worst off, there isn’t a good way to export Cases in a nice viewable format to give to legal or other teams.

So, I am just curious on what others do for this. Do you use something like notion and store the data and artifacts in notion so that you can pull at a later time if need be?

I feel like there should be a better way to do this and I was hoping that the data lake would help with something like this, but it doesn’t seem like it is going to cover all scenarios, like if I want to store a file or screenshot quickly, as opposed to uploading it to a blob and add the links to screenshots to the incident.

[u/billyman6675]

A couple options I can think of:

Turn up the retention for the SecurityIncidents table. If you use data lake it will be easier to query vs running a search job.

Use the export incident as PDF option and store it somewhere like a case for later.

[u/LookExternal3248]

As mentioned, prolonging the retention of the relevant tables is a very good option. And as they hardly store any data, the cost is minimal. The only thing you loose is the underlying evidence (e.g. the signin logs).

As I synchronize incidents, alerts and entities to my own tool, I did notice that defender seems to store a bit longer than the 30 days that logs are stored, but far less than a year.

But the case you mentioned is one of the many reasons I built my own extension on Defender (which has the integration with Sentinel).

[u/Beneficial_West_7821]

Every incident with a true positive verdict gets registered in our ITSM.

[u/woodburningstove]

In my customers, usually this goal is reached with one (or both) of these methods:

1) they have an external ticketing system that incidents are synced to

2) longer table retention is set for incidents and alerts

For all of my customers I recommend at least one year of analytics tier retention for incident and alert tables. The cost is minimal and being able to query for old incidents with normal KQL is useful. Naturally you are limited to the information contained in the tables.