- Separate collection coverage, retention duration, and retrieval speed.
- Estimate storage and query costs using measured event volume.
- Test an archived investigation record before relying on the archive.
A log archive can meet its storage target and still fail an investigation. If nobody can retrieve the right tenant, time range, and event fields before a decision is due, the organization has retained bytes without a usable response process.
Start with the questions the team expects to answer after delayed detection. Identity misuse, cloud configuration changes, and customer-data access may require different sources and retrieval times. Use the cloud and SaaS evidence map to establish coverage before choosing durations.
Set a requirement for each source
Record the investigation purpose, data sensitivity, expected detection delay, contractual or legal requirements, and the owner who accepts the proposed retention. Ask counsel or the appropriate records owner about preservation obligations; there is no universal duration that fits every company and log type.
Distinguish native service retention from exported copies. For example, Microsoft's Entra retention documentation explains that retention varies across reports and licensing. Check your actual configuration and export path rather than assuming an archive is populated because a diagnostic setting exists.
Decide how quickly each source must be searchable. Recent detection data may need immediate access. Older evidence may tolerate a documented retrieval delay, provided that delay fits the incident and business requirements.
Estimate cost from measured volume
Measure representative daily volume, including bursts and required event categories. Do not estimate solely from a quiet weekday. Identify ingestion, indexing, storage, retrieval, transfer, and query charges in the selected service.
As a hypothetical capacity example, a source generating 20 GB per day would produce about 600 GB over 30 days before compression, replication, or index overhead. That arithmetic is not a vendor price estimate. Apply measured compression and the provider's billing model separately, and include the cost of an archive query or restore.
Compare alternatives using the same required evidence. Removing repetitive operational noise may be reasonable; sampling security events needed to reconstruct a specific user's actions may make that reconstruction impossible. Have the investigation owner approve filtering decisions and test their effect.
Preserve meaning when normalizing
A common schema can make identity, resource, action, and outcome fields easier to query across sources. Keep the source timestamp, timezone interpretation, stable identifiers, and original record available. Parsing errors or discarded fields can matter months later.
Document parser changes and test representative records after updates. Restrict archive write and delete permissions, log administrative changes, and consider appropriate integrity protections. Retention that an ordinary compromised administrator can silently shorten needs review.
Run a retrieval drill
Select an authorized historical test event whose details are known. Have the assigned responder request and retrieve it from the archive using the incident access path. Measure approval time, restore time, query work, and any missing fields. Check that it correlates with the current identity and asset records.
Record who can request preservation when an incident or other obligation requires it. Review expiration and deletion behavior so a retention change does not accidentally remove evidence already subject to preservation.
Present leadership with the required investigation coverage, estimated recurring cost, tested retrieval delay, and specific gaps. That supports a budget decision about evidence the business can actually use, rather than a contest over the longest retention setting.
Map the logging and retention evidence needed to support detection, investigation, and leadership reporting.