By default Microsoft Defender for Endpoint stores Endpoint events in Defender for Endpoint for the configured retention period; Max: 180 days.  For longer data retention it is possible to export events to external sources, most typical; Azure Storage or Azure Event Hubs. In…