QA Pro AcademyCybersecurity A-Z
Join free
← Back to catalogue
Wrenfield Stores' log retention decision: the Hartside investigation, where endpoint logs reached back only 45 days so the first 24 days of the intrusion were invisible and all 612 stores stayed in scope at a cost of £6.8M; three ways to keep, where cutting every log to 30 days fails five legal floors, keeping everything for 400 days costs £6.27M and breaches privacy ceilings, and tiered retention by value runs at £3.52M a year; and a retention timeline for eight log families, each with 30 days hot and warm or cold history kept to its legal floor and evidenced need, never past its privacy ceiling.
CY-PRO-104Pro Level · SIEM Engineering

Log Retention Value and Cost Decisions

Help the board decide how long security logs are kept — and what that buys.

40 hours12 chapters60 lessons433 activities12 labs

What you'll learn

  • Measure what log retention buys from the organisation's own investigations, and decompose SIEM cost into the parts days and volume each move.
  • Scope legal and contractual floors and privacy ceilings precisely, and design tiered retention that meets them at the lowest defensible cost.
  • Reduce log volume without losing evidence or detections, and set investigative need by a rule that updates itself from every post-mortem.
  • Appraise retention options by total cost of risk, govern the chosen strategy with owners, gates and indicators, and win a resolution the Board can be held to.
Price:৳15,000
Sign in to get access

Sign in to enrol — you can pay by bKash or Nagad, or apply a promo code.