Topic starter
25/10/2026 11:04 am
TL;DR: Archive-only SIEM retention turns old logs into restore tickets, according to TENZIR, so audits and incident reviews wait on rehydration before they can search evidence. Object storage with partitioned Parquet keeps history queryable in place, which cuts delay and makes retained logs usable.
Editorial analysis by NHI Mgmt Group, based on content published by TENZIR: “Seven years of logs without seven years of SIEM”.
By the numbers:
- The annual cost of 7 searchable years in the SIEM is $1.18M, compared with $56k in object storage.
- The archive tier costs $473k annually, while object storage costs $56k in the same model.
Key questions
Q: When should organisations choose searchable retention over cheaper archive-only storage?
A: Whenever compliance, audit, or incident response requires fast access to history older than the SIEM hot window.
Q: What are the signs that historical log retention is failing in practice?
A: Common signs include restore tickets for every older investigation, long delays when auditors ask for dated evidence, and repeated confusion between what is retained and what is searchable.
Q: Why do SIEM archive tiers create problems for audit and incident response?
A: Archive tiers preserve data but remove immediate query access, so investigators have to restore logs before they can search them.
Practitioner guidance
- Define the searchable retention boundary Document the day where logs stop being directly queryable and map it against audit, legal, and incident response requirements.
- Keep a second copy outside the SIEM Stream events into owned object storage in parallel with the SIEM so long-term history remains queryable without rehydration.
- Partition historical events by class and day Organise the archive so investigators can target the exact event class and date range they need instead of restoring the full dataset.
Bottom line: Long-term log retention is not useful if the only way to search it is to restore it first.
Glossary terms: Searchable retention, Reset Workflow, Partitioned Log Storage, Hot Window
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 7 days ago by NHI Mgmt Group
27/10/2026 7:17 pm
Searchability is the real control, not retention duration: a log that exists only in cold storage is not operational evidence. Audit and incident teams need direct access to historical events, especially when identity traces sit outside the hot SIEM window. The governance failure is assuming retention and queryability are interchangeable. Practitioners should treat searchable history as a distinct control objective, not a storage side effect.
A question worth separating out:
Q: How should teams structure long-term log storage to avoid restore-based searches?
A: Use a partitioned format in object storage, organised by event class and date, so queries can target only the relevant slice of history. That preserves searchability, reduces wasted retrieval, and lets the SIEM focus on the hot detection window while the archive remains directly usable.
👉 Read our full editorial: Searchable log retention is cheaper than SIEM archive restores
This post was modified 7 days ago by NHI Mgmt Group