ThreatDefence is the only SecOps as a Service company providing broad coverage across your entire technology stack with evidence-based security.
We provide security teams with full-stack SecOps infrastructure – you get deep visibility from day one, gain control over your security data, and get access to a comprehensive set of ready-to-use tools, detections, workflows, playbooks and scenarios.
24×7 managed detection and response across endpoint, network, cloud, identity, and log sources
Eyes-on-glass SOC and continuous threat hunting
Protect your entire technology stack and build your SecOps on your own pace
White-labeled AI SOC for every client tenant, co-managed with our SOC team
Launch your SOC business without any upfront investment
Get ultimate assurance that your environment is free from threat actors
Quickly recover from cyber attacks and breaches
24×7 SOC, Continuous Monitoring, Threat Containment and Incident Response
Visibility and actionable insights for all IT assets
Leverage our Cyber Range to train defenders based on real-world scenarios and simulations
OT and industrial cyber security services for critical infrastructure
Cloud-based SIEM platform providing visibility across all your data sources
Manage your external footprint, publicly available data, and Dark Web leaks
AI triage, investigation and response on the tools you already run
Fully featured distrubuted NDR for on-premises and public cloud environments
Deploy honeypots and honeytokens and stay ahead of threat actors
Every alert investigated, with a verdict and the evidence behind it
Integrated endpoint agent providing deep visibility, response and forensics
Log management and threat detection across any of your log sources
A SecOps platform purpose-built for industrial and OT environments
ThreatDefence puts security and compliance at the heart of our service, keeping your data protected at all times.
See how we keep your data secure.
Guides, case studies, and advisories in one place
Articles on security operations, AI and compliance
Events, awards and company news
Read what our customers say about us
Solution briefs and datasheets
How we keep your data secure
Technical support and knowledge base
October 31, 2026
October 21, 2026
October 16, 2026
Essential Eight monitoring, reporting, and evidence for ongoing compliance
Privacy Act reform impacts, obligations, and practical security considerations
Monitoring and compliance support for critical infrastructure environments
A practical guide to securing critical infrastructure with continuous monitoring
A practical buyer’s guide for schools evaluating SIEM and SOC services
A practical guide to selecting the right SIEM and SOC service for local government
How AI agents investigate alerts and run security operations
How AI SOC platforms work, from integrations to autonomy
Free ebook: a practical guide to adopting an AI SOC platform
A practical guide to Incident Response and Digital Forensics
Read how cyber range helps to train cyber defenders
How brand impersonation works and how to detect and stop it
How lookalike domain attacks work and how to take them down
We provide end-to-end SecOps solutions for Managed Security Service Providers (MSSPs), Managed Service Providers (MSPs), and Value-Added Resellers (VARs).
Find out how you can become a ThreatDefence partner.
Where SOAR playbooks fit, where AI agents take over, and how the two work together.
AI SOC hyperautomation transforms cybersecurity ops by autonomously detecting, analyzing, and remediating threats.
Honored to Support the Launch of the University of Technology Sydney Cybersecurity Precinct!
ThreatDefence Cyber had the privilege of meeting with Honeywell Dubai’s Digital City leadership to explore synergies in OT/SCADA and…
Read More
Equinox to support companies with ready to use, end-to-end SecOps infrastructure, including a full stack platform able to capture and…
ThreatDefence had an amazing time at AISA CyberCon 2024, connecting with industry leaders and advancing cyber security conversations.
SIEM log retention defines how long security events remain available and how quickly they can be searched. A useful policy supports investigations, meets applicable requirements, and controls storage costs.This guide explains searchable and archived retention, key framework requirements, and how to keep historical evidence usable.
An investigation may start well after the activity occurred. Analysts need earlier records to establish when access began, which systems were involved, and what happened afterward.
Retention also supports service reviews, audits, and incident reporting. Records can show which events were collected, how findings were investigated, and which actions followed.
Keeping data is only part of the requirement. The records must remain accessible, understandable, and protected for the period they are needed.
A practical retention plan answers three questions:
Searchable retention and total retention are different commitments.
Searchable logs can be queried directly through the platform or another supported analysis service.
Archived logs remain stored but may require restoration, rehydration, or another preparation step before analysis.
Storage terminology varies between providers. Confirm the actual retrieval process rather than relying on labels.
An archive is not automatically a backup, and a backup is not automatically a usable log archive. Retained records need a tested path back into an investigation.
Requirements depend on the organization, systems, records, and obligations in scope. Searchable periods, total retention, and required documentation should be treated separately.
Requirements reviewed in October 2026. Apply them to the relevant systems and record classes, alongside other applicable schedules, contracts, and preservation requirements.
PCI DSS requires at least 12 months of audit-log history, including at least the most recent three months immediately available for analysis.
A design can therefore use directly accessible recent history and a different storage tier for older records, provided the full retention and availability requirements are met.
Document:
A configured storage policy alone does not demonstrate that investigators can use the retained evidence.
The current ISM separates searchable retention from records retention:
Event logs are retained in a searchable manner for at least 12 months.
Event logs are retained according to applicable minimum periods in AFDA Express Version 2.
The AFDA classification matters. Its Technology and Information Management authority directs relevant access and change-history logs to class 62625, which specifies seven years after action completed. Class 63000 specifies 18 months after action completed for DNS and web proxy event logs.
The authority also distinguishes other operational logs that may fall under an agency’s normal administrative practice policy.
The practical implication is that a 12-month searchable window may need to sit alongside a longer archive. Record the applicable class and its retention trigger, rather than applying one period to every source.
OMB Memorandum M-26-14, issued May 22, 2026, rescinded M-21-31 and established a revised logging approach for agencies within its scope.
Its minimum baseline requires logs to be:
Both periods start when the log is created. This is not a requirement for six months followed by another 12 months.
Other applicable records schedules can require longer retention.
Requirements sometimes apply to security policies, assessments, incident records, or financial records rather than every event collected by a SIEM.
HIPAA illustrates this distinction. Its Security Rule documentation provision covers required policies, procedures, and documented actions or assessments. The six-year period should not be copied into a SIEM policy as though it automatically applies to every raw event.
Likewise, a framework name alone is not a retention policy. Identify the specific requirement, record category, scope, and starting point for the period.
Retention should reflect both investigative value and applicable obligations.
Filtering can reduce volume, but it needs validation. Repetitive events may still support sequence detection, behavioral analysis, or reconstruction of an incident.
A written policy should translate requirements into settings that can be checked.
Record the applicable laws, standards, contracts, records schedules, and internal requirements. Identify the relevant sources and record categories.
Specify searchable retention and total retention separately. State when each period begins, including any event-based trigger.
Define where records move, how they remain protected, and what retrieval requires.
Assign responsibility for policy approval, platform configuration, source coverage, archive access, and exceptions.
Define how investigations, legal holds, or disposal freezes suspend normal deletion.
Document how records are removed when retention ends and no preservation requirement applies.
Revisit the policy when obligations, systems, data sources, service providers, or investigation needs change.
Retention cost includes more than the amount stored.
Consider ingestion, indexing, searchable storage, archive capacity, query charges, restoration, data transfer, and operational work.
A useful planning model starts with daily volume by source and the required period in each tier. Then account for measured compression, index overhead, replicas, and growth.
Use representative measurements. Raw-log volume, indexed storage, and compressed archive size are different figures.
Recent events stay hot for search, dashboards, detections, and investigations across every tenant you manage.
hids-2026.10.29
firewall-2026.10.29
td-alerts-2026.10.29
o365-audit-2026.10.28
firewall-2026.07.30
The archiver copies indices to S3-compatible buckets you own, with retention set per index pattern.
td-alerts-*
firewall-*
o365-audit-*
hids-*
Retention needs to preserve integrity and availability as well as duration.
Limit who can view sensitive records, delete data, or change retention settings. Record administrative changes.
Use appropriate immutability or retention-lock controls where required. Configure them carefully, including who can change policies or remove protection.
Use checksums, manifests, and verification processes to help identify missing or altered archive objects.
Retained data is unusable if its keys are lost or destroyed. Key availability must cover the required retrieval period.
Reduce the chance that compromise of a monitored environment also gives an attacker control over the evidence store.
Customer-owned storage can support control and portability, but ownership alone does not establish protection. Permissions, lifecycle settings, keys, and retrieval procedures still need management.
A retention policy is proven by retrieving usable evidence.
Select records near the oldest required point and test the full process:
Check that timestamps, fields, and source context remain understandable. Confirm that archived formats and restoration procedures still work after platform changes.
Set a test schedule based on requirements and risk, and repeat testing after significant changes to storage, access, encryption, or providers.
Confusing storage with availability Data may exist in an archive but take longer to retrieve than the investigation can tolerate.
Applying one period everywhere Different records can have different requirements, value, and retention triggers.
Treating documentation rules as log rules A period applying to policies or assessments may not apply to all raw events.
Ignoring collection gaps A retention setting cannot recover logs that were never collected.
Losing the retrieval dependencies Expired credentials, missing keys, unsupported formats, or unavailable staff can make an archive unusable.
Deleting during preservation Normal lifecycle rules need a controlled way to accommodate holds and active investigations.
ThreatDefence Next Generation SIEM keeps recent records searchable for detection, dashboards, hunting, and investigation. Configurable archiving supports longer-term retention in S3-compatible storage, including customer-owned storage.
Retention policies can be applied to different data sets. Authorized users can export selected records by source, query, and time range, while source-health monitoring helps identify collection interruptions.
Searchable periods, archive retention, access controls, and retrieval arrangements are agreed around your requirements.
No events for 47 minutes against a steady baseline. Analysts are checking the device and the collector before the gap widens.
Explore Next Generation SIEM
CountryAustraliaUnited StatesNew ZealandUnited KingdomCanadaSingaporeOtherI'm an MSP, MSSP, or reseller
Δ
There is no universal period. Define searchable and total retention for each record category using applicable requirements, investigation needs, and business policy.
It requires at least 12 months of audit-log history, with at least the most recent three months immediately available for analysis. The availability requirement and total retention period are different.
No. Its 12-month searchable requirement operates alongside retention under applicable AFDA Express Version 2 record classes, which can require longer periods.
Its six-year documentation requirement should not be treated as a universal period for every SIEM log. Determine which records are required documentation and which other retention obligations apply.
No. Product terminology varies. Some services query older storage directly; others require restoration. Confirm the steps, performance, and charges.
Not necessarily. An archive is designed to retain records for later access. A backup primarily supports recovery. Either must be evaluated against the required integrity, retention, and retrieval outcomes.
Yes, where the platform supports it. Confirm ownership, permissions, storage location, retention settings, encryption keys, and the process for retrieving evidence.
Suspend applicable deletion through the approved preservation process and retrieve the relevant records. Preserve their context and document access, integrity checks, and exports.
Not automatically. Different records may have different obligations and investigative value. Document the reason for each policy and validate its effect on detection coverage.
What Is SIEM as a Service?
AI SOC Platform Guide
What Is Network Detection and Response?