{"id":"azure-monitor-workspace-security-nexus","text":"Log Analytics workspace configuration decisions (retention periods, table plans, DCR filtering) directly impact three product consumers — Azure Monitor, Microsoft Sentinel, and Microsoft Defender for Cloud — because the dual ingestion model (metrics time-series + Log Analytics workspace) feeds all three through the shared data platform; a misconfigured workspace degrades security observability, not just operational monitoring.","truth_value":"IN","source":"","source_url":"","source_hash":"","justifications":[],"dependents":[],"metadata":{},"explanation":{"steps":[{"node":"azure-monitor-workspace-security-nexus","truth_value":"IN","reason":"premise"}]}}