Log retention

Retention has to satisfy investigation, cost, privacy and regulation simultaneously, and those pull in different directions.

Investigations want years. Cost wants weeks. Privacy law wants no longer than necessary. Regulators sometimes specify a minimum. The result is usually a compromise set by budget alone, and the number worth knowing is how long the intrusions you are likely to face go undetected, because retention shorter than that makes the investigation impossible.