SecurityInsight settings · Settings > Data & retention

Copy records to Log Analytics

Key	SI_LaExport
Where	Settings > Data & retention > Where collected data goes
Type	enum
Default	off: the records are kept only in the database
Edition	Community

What it does

Optionally copies the provider records (every object a collection reads, mapped to SI fields) to Log Analytics, for Azure Monitor or your own workbooks.

When set

'records' also posts every record to SI_Record_CL (and, for the providers raw data is on for, the whole object to SI_RecordRaw_CL) on every collection run. This costs Log Analytics ingestion for every record, every run. It is a one-way copy: correlation, the CI build and the data sync read the records from the database only and never read this copy back. The CIs (SI_CI_CL) are in Log Analytics in every install, because Risk Analysis reads them there, so they need no setting; the findings per CI are copied there only when Copy findings per CI to Log Analytics (SI_Finding_CL) is on.

When blank or default

Left blank, the default applies: off: the records are kept only in the database

Risk and how to reverse it

Changes how long data is kept or how quickly assets are treated as gone. Shortening a retention DELETES older data at the next clean-up and that cannot be undone; shortening a grace period retires assets (and closes their findings) sooner. Lengthening is safe but uses more storage.

Requires

Nothing else.