Also known as: Security Log Retention
The period and storage tier in which security events remain available for search, investigation, threat hunting, audit, or recovery.
SIEM data retention describes how long security telemetry is kept and how quickly it can be searched. Current data may remain immediately searchable while older records move to a lower-cost archive that requires retrieval or rehydration.
Retention affects both investigation coverage and cost. Buyers should compare the searchable window, archive access, query performance, export options, retrieval time, and charges for using historical evidence.
A platform can retain a record without keeping it immediately usable. Storage duration and searchable retention are different promises.