Setting Halvern Bank's SIEM retention strategy: eight log-category lanes, from identity and authentication to OT and facility logs, each split into hot, warm, cold and archive tiers and meeting its required retention, with payment and application audit logs kept five years; the cost-versus-coverage plot where the programme moves from 24% coverage at £335k a month to full coverage at £230k, inside the Board's target of 95% within £250k; and the incident that started it, an investigation that needed 432 days of authentication logs when the SIEM kept 90 and the archive had silently stopped writing.

CY-PRO-024Pro Level · SIEM Engineering

SIEM Cost and Retention Strategy

A forty-hour Pro-level log retention simulation run on a live SIEM retention command board, where you are Head of Security Engineering at a UK bank; an investigation needs fourteen months of authentication logs and finds ninety days and an archive that stopped writing eight months ago — and you measure what is really kept, derive what must be, cut ingest by a third without blinding a rule, lock and prove the archive, respect the privacy ceiling, cut the licence from £3.84M to £2.16M and defend a retention strategy to the Board.

40 hours12 chapters60 lessons433 activities12 labs

What you'll learn

Measure retention honestly — configured against proven, days against requirements — and contain a live loss of evidence without deciding what belongs to others.
Derive retention requirements from law, contracts and real cases, price every source by licence and tier, and place each day where its use is served at least cost.
Reduce ingest without blinding detection, make retained logs immutable and provably restorable, and keep nothing beyond its lawful limit.
Negotiate the licence from a priced alternative, decide what belongs in a data lake, price strategies at the margin and win a resolution the Board, the supervisor and internal audit can test.

Price:৳15,000