SecurityInsight settings · Settings > Data & retention

Copy findings per CI to Log Analytics (SI_Finding_CL)

Key	SI_RA_Findings
Where	Settings > Data & retention > Where collected data goes
Type	On / off
Default	Off: the findings per CI are kept in the database only
Edition	Community
Confirmation	SecurityInsight asks you to confirm before it is switched on.

What it does

Optional. After each Risk Analysis Detailed run, copies the de-duplicated findings (one row per CI and finding) into your Log Analytics workspace, for your own workbooks, Sentinel or KQL. SecurityInsight itself does not need it: its pages read the findings from its database. On a large estate the copy can take hours and adds Log Analytics ingestion cost. Off by default.

When enabled

at the end of every Risk Analysis Detailed run its findings per CI are also posted to SI_Finding_CL, and the run ends when the copy has ended. On a large estate that is hours, and it costs ingestion for every finding, every run. The data sync reads that copy back only when it is the newest and whole; otherwise it makes the findings per CI from the database, as it does with the copy off.

When disabled

nothing is copied. This is not the Risk Analysis report rows (SI_RiskAnalysis_Detailed_CL): they are their own optional output, Copy Risk Analysis report rows to Log Analytics, off by default.

Risk and how to reverse it

Longer Risk Analysis Detailed runs and Log Analytics ingestion cost for every finding, every run. SecurityInsight itself does not need the copy. Reversible: turn it off and the next run copies nothing.

Requires

Nothing else.