Topic starter
14/09/2026 10:09 am
TL;DR: Full-fidelity log retention is being squeezed by rising ingest prices, growing telemetry volumes, and expensive retrieval, according to Anomali’s analysis of Microsoft, Dynatrace, and Splunk pricing and survey data. The practical shift is from hot-index dependence to decoupled storage and query, because long retention only works when searchability no longer inherits SIEM economics.
Editorial analysis by NHI Mgmt Group, based on content published by Anomali: “Full Fidelity at Cold-Storage Cost: The Retention Economics”.
Key questions
Q: Why do long-retention security archives become unusable in practice?
A: Because many platforms price ingest, indexing and retrieval together, so older data may be retained but not economically searchable.
Q: How should security teams design retention for identity investigations?
A: Teams should preserve authentication, session and access data in a common schema before it leaves the hot tier.
Q: What breaks when telemetry is not normalised before analysis?
A: Cross-source correlation becomes unreliable, identity and network events are harder to match, and AI tools have to learn around inconsistent labels instead of analysing behaviour.
Practitioner guidance
- Separate hot detection from historical hunting Keep recent, latency-sensitive data in the primary analytics tier, but move older telemetry to low-cost object storage with elastic query for retrospectives.
- Normalise identity events before cold storage Map authentication, session and access events into a common schema so investigators can query human and non-human activity across sources later.
- Model retrieval as part of retention cost Include scan charges, restore jobs, query compute and egress in the retention budget, not just storage price per gigabyte.
Bottom line: Long-term SOC retention fails when the platform charges premium rates for both ingest and retrospective access.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
14/09/2026 10:10 am
Full-fidelity retention is now an access problem, not just a storage problem. When retrieval is expensive or slow, the practical result is that evidence exists but is functionally unavailable to investigators. That creates blind spots across identity timelines, service-account activity and cross-domain correlation. The practitioner conclusion is to govern retentive usefulness, not simply retention duration.
A question worth separating out:
Q: Should teams keep all security data in a hot SIEM tier?
A: No. Hot tiers make sense for recent, latency-sensitive detections, but long-range investigations are usually better served by low-cost object storage and on-demand query. The practical balance is to reserve expensive indexing for the data that needs real-time speed and move the rest to a cheaper, searchable archive.
👉 Read our full editorial: Retention economics expose the real cost of full-fidelity SOC data