Keep security logs centrally, and long enough to scope an intrusion that began well before you noticed it. CISA's SolarWinds alert advises retaining logs for at least 180 days. The Volt Typhoon advisory notes that some Windows logs persist longer than the security log, so check what you really have.
What the sources say
CISA's alert on the SolarWinds Orion compromise recommends retaining logs for at least 180 days and centralising them. It also advises looking for impossible logins and anomalous SAML tokens.
The Volt Typhoon advisory recommends keeping application, access and security logs turned on and stored centrally. It adds hunting hints that depend on log availability:
- Windows ESENT application logs, where certain event IDs may indicate copying of the NTDS.dit file. The advisory notes these logs persist longer than security logs.
- Event ID 1102, which marks log clearing. The advisory says all such entries should be investigated.
- Terminal Services events for unexpected remote desktop sessions.
- VPN and account logins reviewed for impossible travel and unusual frequency or duration.
The advisory also says footholds can last for years, which is why short retention is a handicap.
Why 30 days is often not enough
If an actor was present for months, a 30 day window shows you only the recent part. You cannot tell when entry happened, which accounts were touched first or whether data left earlier. Scoping then depends on guesses.
How to pick your number
- Start with the 180 day figure as a floor for identity, VPN, firewall and domain controller logs.
- Rank by value. Identity provider sign-ins, remote access logs and admin actions are worth more per gigabyte than verbose debug output.
- Cost it. Cold storage is cheap compared with an unscoped incident. Ask finance for the monthly figure.
- Check rules. Your privacy and contractual obligations may set limits or minimums. Ask legal.
- Protect the logs. Send them off the source machines, restrict deletion and alert when logging stops.
Watch for log tampering
Event ID 1102 is a clue, but attackers can also disable logging. Alert when a source stops sending logs. A silent host is a finding.
A test you can run this week
Pick one account and ask: can we show every sign-in for it from 150 days ago? If not, note the gap and fix the pipeline.
Quick check
Is 180 days a legal requirement?
No. It is the figure in CISA's alert advice. Your own obligations come from regulation and contracts.
What if storage cost is a problem?
Keep full detail for high value sources and shorter or sampled retention for noisy ones.
Sources
Last reviewed: 19 October 2026.
