Notifications
Clear all
Topic starter
18/08/2026 2:31 pm
TL;DR: Long-term log storage becomes unsustainable when enterprises warehouse years of security data in SIEMs built for analytics, not retention, according to Axoflow. The practical shift is toward open, self-describing storage that reduces lock-in, preserves queryability, and separates hot analytics from cold archive economics.
NHIMG editorial — based on content published by Axoflow: Long-Term Log Storage Without SIEM Costs: The Axoflow Storage Layer
By the numbers:
- 72% of organisations have experienced or suspect they have experienced a breach of non-human identities, 46% confirmed and 26% suspected.
Questions worth separating out
Q: How should security teams store logs for multi-year retention without SIEM cost blowouts?
A: Use the SIEM for active analytics and keep long-term evidence in open object storage that is cheaper to retain and easier to move.
Q: Why do SIEMs become the wrong place for long-term evidence retention?
A: Because SIEMs are engineered for search, correlation, and alerting, not for low-cost archival storage.
Q: What breaks when long-term log archives depend on proprietary indexes?
A: The archive becomes tied to the original platform, which makes later access fragile if the vendor changes direction, the product is retired, or the environment is migrated.
Practitioner guidance
- Separate hot and cold retention tiers Keep the SIEM focused on alerting and recent investigation windows, and move long-term evidence into open object storage designed for retention.
- Preserve logs in self-describing formats Store retained logs in formats such as Parquet so the archive does not depend on a proprietary index or a running database to remain readable.
- Treat archive access as governed access Apply explicit ownership, access control, and lifecycle rules to the retained log store, including who can query, export, or rehydrate records.
What's in the full article
Axoflow's full blog post covers the operational detail this post intentionally leaves for the source:
- The Parquet and object storage implementation choices behind the storage layer
- The Arrow Flight write path and how it reduces serialization overhead
- The query and rehydration workflow across DuckDB, Python notebooks, and other engines
- The operational tradeoffs of running the archive on-prem, in cloud, or in air-gapped environments
👉 Read Axoflow's analysis of long-term log storage beyond SIEM costs →
Long-term log storage beyond SIEM costs: what teams should change?
Explore further
18/08/2026 3:18 pm
Log retention is an identity governance issue when audit evidence outlives tool cycles. Security programmes do not just store logs for compliance, they preserve proof of who or what accessed critical systems. That matters directly for human identity, service accounts, and other non-human identities because investigations often depend on historical access traces that must remain readable long after the original control stack changes. Teams should treat archive design as part of governance, not as a storage afterthought.
A question worth separating out:
Q: How do organisations keep retained logs usable across platform changes?
A: Maintain open, self-describing storage formats and test retrieval workflows regularly so the archive can survive tool replacement. Pair that with clear ownership, cataloguing, and access rules, because retention only helps if the evidence remains understandable and governed when someone needs it.
👉 Read our full editorial: Long-term log storage beyond SIEM costs needs open formats
