Your organization uses a single Microsoft Sentinel workspace. Compliance requires Windows SecurityEvent data be retained for 180 days in hot storage and then archived, while Syslog data should be retained for 30 days. To reduce ingestion, only Windows event IDs 4624, 4625, and 4688 should be collected. What two actions should you take?

To meet the retention requirements, table-level retention and archive policies are essential. These policies allow you to specify different hot and archive retention periods for individual tables like SecurityEvent and Syslog within a single Log Analytics workspace, directly addressing the problem's distinct retention needs. To reduce ingestion and collect only specific Windows event IDs, a Data Collection Rule (DCR) is the correct approach. DCRs, especially with the Azure Monitor Agent (AMA), offer granular control over data collection and transformation, allowing you to filter events at the source before ingestion into Sentinel, thereby minimizing costs and adhering to compliance. The other options are incorrect because: A workspace daily cap controls overall ingestion but doesn't allow for per-table retention differences. Creating separate workspaces is unnecessary and adds management overhead when table-level retention can achieve the same goal within a single workspace. The legacy Security Events connector is deprecated and lacks the advanced filtering capabilities of DCRs with AMA.