Separate searchable retention from stored retention
A record can still exist without being immediately searchable. Ask what the contracted retention window means for each source. Confirm whether historical queries use the same fields and permissions as recent searches.
An investigation may start well after the first suspicious event. The useful question is whether the team can reconstruct that earlier activity with the evidence it retained.
The SIEM data retention definition explains the basic distinction. Use the commercial tests here to turn that distinction into a requirement.
Find out what happens to archived evidence
Archive storage can have a different retrieval process from the live investigation system. Ask whether a restore needs a support request and how charges are calculated. Measure the time from request to usable search results.
Restore a sample older record during evaluation. Check its original timestamp and source details against a retained copy. A promise that data is backed up does not answer whether the analyst can search it during an incident.
Write retention requirements by source
| Decision | What to specify | What to test |
|---|---|---|
| Searchable evidence | Required query window for each source. | Find a known event near the age boundary. |
| Archived evidence | Restore process and the acceptable waiting time. | Retrieve a representative archived record. |
| Volume and growth | Measured billable volume and expected peaks. | Reconcile a pilot usage report to a quote. |
| Evidence preservation | Original event context and export needs. | Export and independently read a complete case. |
| Retention ownership | Who sets policy and who approves changes. | Review permissions and deletion settings. |
Measure volume where the contract bills it
Raw bytes at a source, compressed bytes in transit and stored bytes can be different quantities. Put the billed measurement point into the quote. Ask how duplicates and replays affect usage.
Use a representative work period and include a busier interval when available. Record the source of each estimate. A short pilot with no incident activity is a limited baseline rather than a guaranteed maximum.
For a fixed daily stored volume, a first planning estimate is daily volume multiplied by retained days. Compression and the product billing method can change the commercial result. Confirm the provider calculation before turning the estimate into a budget.
Keep original context with normalized events
Normalization helps join records across tools. It should not leave the analyst unable to explain how the original event became a field in the case.
Test export of a complete investigation. Include original evidence references and the searches used. Confirm that a person outside the product can read the exported material and distinguish an AI summary from source evidence.
Operational log retention and a legal preservation requirement can call for different handling. Have the appropriate owner set those requirements; a SIEM subscription does not decide them.
Assign retention and recovery responsibilities
Confirm who can shorten retention or change source filters. Review how retention settings interact with tenant scope and account termination.
Fluency currently publishes one year of retention across its packages. Its public pricing also separates seat charges from excess stored volume. Ask how those published terms apply to the specific sources and historical-search requirements in your quote.
Use the AI SIEM pricing guide to include retrieval and exit costs in the same comparison as ongoing storage.
Bring your security question to Midland
Tell us which systems you need to protect and where investigations get stuck. We can review the AI Native SIEM offering against that requirement.
Review our AI Native SIEM and SOC platform or discuss your environment with us.
Sources and technical scope
Checked October 23, 2026. Product capabilities and supported integrations depend on the offered configuration. Planning examples below are evaluation guidance, not measured customer results.