Process and analysis
What is Log retention?
How long log data is kept before deletion, which sets how far back an investigation can look.
Log retention is how long an organisation keeps each type of log before it is deleted or overwritten. It decides how far back any investigation can look.
Attackers often sit in a network for weeks before they are found. If proxy or DNS logs are kept for seven days, a threat report about activity last month cannot be checked against your own data. Retention is a cost decision that should be made with the investigation use case in mind.