Retention determines how far back you can investigate
Whatever happened before your retention window is unknowable.
If you keep thirty days and the compromise began in March, the beginning of the story does not exist. You can establish that something is wrong and not how it started, which means you cannot be confident it is closed. Retention is not a storage decision dressed up as a security one; it decides which incidents you are capable of understanding.
More on Logging and telemetry
- A log records an observation, not objective truthThe shadow, not the thing
- Central logging reduces local erasure riskIt left before you got there
- Verbose logging can leak secretsEverything, including that
- Telemetry coverage should map to detection questionsPoint it at the question
- Parsing errors can silently break detectionsSilence is not the same as clear
- High-volume logs can hide high-value eventsBuried by the ordinary