Lion Cipher Lab
Size log storage for a retention requirement
- Cyber / Security Engineer
- Intermediate
- ~45 min
- Free · no account required
Why it matters
Log retention is a requirement in almost every framework, and somebody has to turn that requirement into storage. PCI DSS requirement 10.5.1 asks for audit log history to be kept for at least 12 months, with at least the most recent three months immediately available for analysis. US federal agencies work to OMB memorandum M-21-31, which sets 12 months in active storage and a further 18 months in cold storage for many log types. CIS Control 8 asks for audit log retention and management, and NIST SP 800-92 covers log management planning. The engineering question underneath all of them is how…
What you'll learn
- turning a retention requirement into hot and cold storage tiers
- estimating daily log volume from devices, event rates and event sizes
- the assumptions that dominate the estimate: peak, replicas, compression, growth
- measuring average event size from your own logs
- why naive estimates undershoot
- finding the cost levers: hot retention and the biggest sources
- reading PCI DSS 10.5.1 and OMB M-21-31 retention rules
Steps in this lab
- From a retention rule to storage tiers
- Measure your sources
- Write the sizing model
- Run it for a PCI-style requirement, and against the naive estimate
- Find the levers
- Make the estimate defensible