Authentication trail, API health and outages, agent activity, AD offboarding evidence (legal record), operator audit log, privileged actions, and external dependencies. Filter, inspect, and export per category.
How long this client keeps log/event data and offboarding evidence. Saved as a per-client preference and applied to the Log Analytics workspace and evidence blob lifecycle on the next infrastructure sync. Retention governs storage duration only — it does not change how much data is ingested.
{}