This demo takes viewers on a whirlwind tour of Microsoft Sentinel data lake capabilities in the Microsoft Defender portal. It begins with table management, showing how to review analytics and data lake tiers, adjust retention settings, and configure an Azure Firewall application rules table with 90 days of analytics retention and two years of total retention. It also demonstrates managing connector-associated tables, querying data with Kusto Query Language across workspaces and system tables, revisiting query history, and creating jobs from KQL queries. The tour finishes with Jupyter Notebook resources and Cost management tools for tracking storage, ingestion, querying, processing, and notebook usage—plus configurable notifications for keeping runaway data-lake consumption from developing expensive hobbies.
We produced this demo (one of many) from detailed product recordings, shaping a broad platform tour into a clear journey through configuration, exploration, and cost management. Our edit keeps dense tables, menus, and metrics readable while guiding attention to the settings that matter most. Professional voiceover recorded in our studio provides a steady throughline, helping the many features feel connected rather than piled into one very ambitious interface. The result is a polished introduction that helps viewers understand not only where Sentinel data lake features live, but how the pieces work together.
The inevitable sequels
Hollywood keeps stretching good ideas into progressively worse sequels. We don’t. These are the related videos—spiritual siblings of the one you just watched—as good or better than this video. Expect callbacks, new plot twists, and maybe even a scene-stealing cameo from a lower third.
