Listen to this Post
GitHub Project: retentionManager.ps1
A PowerShell script designed to configure total retention and interactive retention for Microsoft Sentinel and Log Analytics tables at scale.
Key Features:
- Fetch Sentinel/Log Analytics tables (Analytics/Basic/Aux) and retention configurations.
- Filter and search tables for targeted modifications.
- Modify total retention and interactive retention for single or multiple tables.
You Should Know:
1. How to Use retentionManager.ps1
Installation & Execution:
Clone or download the script from GitHub Invoke-WebRequest -Uri "https://github.com/markolauren/retentionManager/raw/main/retentionManager.ps1" -OutFile "retentionManager.ps1" Run the script (requires Azure PowerShell module) .\retentionManager.ps1 -WorkspaceId "your-workspace-id" -ResourceGroup "your-resource-group"
Modifying Retention for Multiple Tables:
Set retention for all SecurityEvent tables to 180 days (total) and 30 days (interactive) .\retentionManager.ps1 -TableFilter "SecurityEvent" -TotalRetentionDays 180 -InteractiveRetentionDays 30
Filtering Tables by Type:
List all Basic logs tables .\retentionManager.ps1 -ListTables -TableType "Basic"
2. Essential PowerShell Commands for Log Management
Check Current Retention Settings:
Get-AzOperationalInsightsTable -ResourceGroupName "RG-Name" -WorkspaceName "LA-Workspace" | Select-Object Name, RetentionInDays, TotalRetentionInDays
Update Retention via Azure CLI:
az monitor log-analytics workspace table update --name "SecurityEvent" --resource-group "RG-Name" --workspace-name "LA-Workspace" --retention-time 90
Bulk Update Using CSV:
Import-Csv "tables.csv" | ForEach-Object {
.\retentionManager.ps1 -TableName $<em>.TableName -TotalRetentionDays $</em>.RetentionDays
}
3. Linux & Windows Log Retention Commands
Linux (Journalctl Retention):
Set systemd journal max retention to 1 month sudo journalctl --vacuum-time=30d Limit journal size to 500MB sudo journalctl --vacuum-size=500M
Windows (Event Log Retention):
Set Security log retention to 90 days wevtutil sl Security /ms:7776000000
Check Log Sizes (Linux):
du -sh /var/log/
What Undercode Say:
Managing log retention is critical for compliance (M-21-31, GDPR, CIS) and cost optimization.
– Use retentionManager.ps1 to automate Sentinel retention policies.
– Combine PowerShell and Azure CLI for hybrid log management.
– Regularly audit logs with KQL queries in Sentinel.
Expected Output:
TableName TotalRetention InteractiveRetention <hr /> SecurityEvent 180 30 SigninLogs 90 7 AzureActivity 365 30
For more details, visit: GitHub – retentionManager.ps1
References:
Reported By: Markolauren Sentinel – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
