Full Fidelity at Cold-Storage Cost: The Retention Economics

Microsoft Sentinel bills pay-as-you-go ingestion at $4.30 per gigabyte in its East US region, per Microsoft's published pricing, climbing toward $5.13 in higher-cost regions like Switzerland North. Standard cloud object storage runs around two cents per gigabyte per month. That gap is the retention problem: teams pay premium ingest-and-index rates to hold data they mostly touch only for the occasional historical investigation.

Why Does Full-Fidelity Retention Get Cut?

Because keeping everything hot is priced to discourage it. Full-fidelity logs stay in the analytics tier for 30 to 90 days, then age into cheaper, slower tiers where retrieval is costly enough that the query often might not get run. Volume keeps climbing while that happens. Dynatrace's 2026 State of Log Management report, drawn from a survey of 450 senior IT leaders, found log and telemetry volume rose 93 percent on average over the prior year, with a fifth of organizations seeing growth above 150 percent. Renewal terms press from the other side: Splunk's standard uplift is 9 percent a year on license and subscription renewals unless a customer negotiates otherwise, a figure Splunk publishes in its own pricing FAQ. Rising volume against a rising per-unit price is a squeeze with no natural ceiling, and the first thing that gets sacrificed is how far back you can look.

How Much Retention Actually Costs

The cost lives in where data sits after the hot window closes and what it takes to get it back. Consider a SOC ingesting 500 gigabytes a day, a mid-size number. That is roughly 15 terabytes a month you might want searchable for a year. Take a single month's slice and hold it for the remaining nine months of the year, and the three common options diverge sharply. These are list-price illustrations and averages, not quotes, and rates vary by region and tier, so run them against your own bill:

• Interactive / extended retention, listed around $0.10 per GB per month: 15 TB held nine months is about $13,500, for one month's data alone. Twelve months of ingestion stacks twelve of those slices behind it.

• Archive tier, around $0.025 per GB per month: storage drops roughly fourfold to about $3,400 for the same slice, but every retrospective query triggers a search-or-restore job billed per gigabyte pulled back, and a restored table keeps billing until you tear it down.

• Object storage with serverless query, around $0.02 per GB per month: storage is cheaper still, near $2,700 for the slice, and you pay for compute only when a query runs, not for an index sitting idle around the clock.

The storage delta is real, but the retrieval penalty is what can kill investigations. When pulling data back costs money and takes time, the query that would have caught something gets deprioritized into never.

What A Missed Retrospective Investigation Looks Like

A CISA advisory lands on a Tuesday naming a set of domains and file hashes tied to a campaign that has been active for five months. Every SOC asks the same question: did any of this touch us, and when? Answering it means sweeping DNS, proxy, and authentication logs across those five months. If that data sits in an archive tier, you spin up a restore job over five months of records, pay the per-GB scan charge, and remember to decommission the restored tables before they bill again. If it aged into cold storage with slow, expensive retrieval, teams might sweep the 90 days you have and hope the other four months were clean. There are real business consequences from the investigations you can’t afford to run.

How to Fix the Fidelity-Versus-Cost Trade-Off

The first step is decoupling compute from storage. Hold everything in low-cost object storage, normalized to a common schema, and spin up serverless query only when analytics actually execute. You pay storage prices for storage and compute prices for compute, not for an always-on cluster sized to peak demand. Long retention becomes viable because it no longer rides on ingest pricing. The bill for keeping data and the bill for asking questions of it stop being the same bill, which is the whole point.

Normalization is what keeps year-old data queryable without a per-source translation step every time you hunt. A Windows sign-in (Event ID 4624), an Okta login, and an AWS console authentication all describe one thing: an identity authenticated from somewhere. In their native formats they share almost no field names. Mapped to the OCSF Authentication event class, they land in one schema with shared fields for the actor, the source endpoint, and the result. A hunt for "failed-then-successful logins from a new ASN across every identity source in the last six months" becomes a single query instead of five, and it still runs cleanly against data you archived a year ago. Raw logs retained in twelve dialects are technically kept but practically unsearchable.

Serverless query against object storage is not the sub-second response of a tuned hot index. A broad scan across a year of data returns in seconds to low minutes depending on partitioning, which is fine for a hunt and wrong for a real-time detection, so the hot tier still earns its place for recent data. Cross-region or cross-cloud egress adds cost if your storage and compute do not sit together. And "two cents a gigabyte" is storage only. The compute you spin up for a heavy retrospective hunt is real money, just money you control by choosing when to spend it rather than paying for peak capacity every hour of every day. The model shifts the trade-off from fidelity-versus-cost to latency-versus-cost, which is easier one to manage.

How Much Decoupled Retention Actually Save

Anomali reports cost reductions of up to 67 percent in a large global financial-institution deployment that replaced a legacy SIEM.

We’re moving away from monolithic SIEMs into intelligent, use case-driven architectures with lower costs.” – Head of Cyber Fusion and Security Operations

The mechanism behind it: object-storage economics for retention, serverless compute for query, and deduplication plus noise removal at ingest, so there is less to store and index to begin with.

To model it against your own environment, pull four numbers: current ingest volume and per-GB rate, your retention tiers and their retrieval costs, and the analyst hours lost to slow historical search. Set the augmentation numbers beside them.

Check out more details about the Anomali Unified Security Data Lake to get the details on how full-fidelity telemetry stays searchable for years without the cold-storage retrieval penalty.

‍