Azure logs without the analytics-tier decision.
Azure Monitor and Sentinel price the data you actively detect on, which pushes everything else into basic or archive tiers where investigating means restoring first. CtrlB keeps the full history in your own storage and searchable in place.
Activity log
Microsoft Entra ID
Kubernetes Service
Key VaultDIAGNOSTIC SETTINGS
QUERIES ONLY
One tier
The tier was picked before the question existed
Azure Monitor prices the data you actively detect on, so retention becomes a forecast: guess now which logs an incident will need in a year. Everything else lands in a tier that has to be restored before it can be read.
priced per GB ingested
no alerts, short interactive window
a search job before a search
the tier was chosen months before the question was asked
priced as objects in Blob storage, not as an analytics tier
The tier you pick decides what history you can search.
Analytics-tier pricing forces a forecast before you know what an incident needs. Archive is cheap because it is not queryable — restoring a table adds hours to a question that should take minutes.
Sentinel rules & SOC workflow unchangedThe tiering problem
- Analytics-tier pricing forces a decision about which logs are worth detecting on, made before you know what an incident will need.
- Basic and archive tiers are cheaper precisely because the data in them is not directly queryable.
- Restoring an archived table to answer one question adds hours to an investigation that should take minutes.
- Diagnostic settings that would be useful get left off, because the volume lands in the expensive tier.
How it works
Diagnostic settings already export to Blob storage. CtrlB indexes what lands beside the data — nothing leaves your subscription.
Export to your storage account
Diagnostic settings already support export to Blob storage. Point them there and CtrlB indexes what lands.
indexes beside the export · same region · nothing leaves
Index in place
Indexes are written beside the data in the same storage account, so nothing leaves your subscription.
one query surface · every retained day
Search the whole window
One query surface across every retained day, whether it arrived this morning or two years ago.
Azure’s own dimensions become ordinary facets
Subscription, resource group, region, and category are not a schema you declare — they arrive with the record and are filterable the moment they land, including on data written a year ago.
Anything with a diagnostic setting
There is no per-service connector to wait for. If a resource can export to a storage account, its logs are searchable — and new fields do not need a schema change first.
Activity logMicrosoft Entra IDKubernetes ServiceApp Service
Functions
Container Apps
Virtual MachinesSQL Database
Cosmos DBKey Vault
Azure Firewall
Application Gateway
Front Door
Load Balancer
Virtual Network
Event HubsStorage accountAzure MonitorIcons are Microsoft’s official Azure architecture icons, shown unmodified.
What you get
Entra ID sign-in logs
Activity logs
Resource diagnostics
Your subscription
Multi-cloud
Runs beside Sentinel
Application, infrastructure, database, load balancer, and firewall logs share one data layer — one searchable history instead of five tiered destinations.
See what changed for OnBeQuestions
It does not have to. The common pattern is to keep Sentinel for analytics rules and incident workflow while the high-volume connectors and long-tail retention move to your own storage.
In your own Azure storage account, in the region you choose, with the indexes alongside it.
There is no archive tier to restore from. Every retained object is directly queryable at the same speed.
Yes. One lake spans clouds, with cloud and account as ordinary dimensions.
Put it on your own bucket and see.
Point a source at CtrlB, keep everything else where it is, and compare the same investigation side by side.