Recommendation
Operational and reference context.
Retention is set per table, so the retention for this source is advisory.
How the matrix worksC9 Health, inventory, and reference context
Secondary: health, performance, metrics, diagnostics, inventory, posture snapshots, reference data, and aggregates derived from another collected table
T4 Investigation context
Low-touch context queried during investigations rather than for alerting.
Rows that belong to this source
Facility =~ "local7" and ProcessName =~ "GitLab-Application-Logs"Rules query these rows through the GitLabApp parser.
Sources for this recommendation
- Azure-Sentinel public content corpus Table identity and usage evidence from public analytics rules, hunting queries, parsers, and solution content. Classification, tier, retention, and billing recommendations require human review.
- Log Baseline classification rules Value rules C1-C9 mapped to ASD and CISA guidance, and tier rules T1-T5 including plan support. Stored per table as valueRule and tierRule.
- Log Baseline volume model Judgment-based volume driver and relative volume class per table. Not measured tenant volume.
- ASD ACSC Priority logs for SIEM ingestion: Practitioner guidance Loosely prioritized log categories (EDR, network devices, domain controllers, Windows, virtualisation, cloud, containers, databases, MDM, DNS, Linux, macOS) used by the classification rules. Collection priority, not storage tier.
- CISA Guidance for Implementing M-21-31 Prioritized event types for collection and storage (ICAM, operating systems, network infrastructure, cloud, AWS, Azure, Microsoft 365, GCP) used by the classification rules. Collection priority, not storage tier.