Question

Your organization ingests firewall, DNS, and endpoint telemetry into Google SecOps. Compliance requires that all security logs be searchable for 1 year, but your team has determined that raw DNS logs generate the highest volume and are rarely needed after 90 days for active investigations. Leadership wants to control storage costs while still meeting the 1-year searchability mandate. What is the most appropriate way to configure data retention in Google SecOps?

Accepted Answer

Configure a custom retention policy that applies a shorter retention duration to the DNS log type while keeping the default 1-year retention for the remaining log types

Answer

Set the tenant-wide default retention to 90 days and re-ingest DNS logs manually whenever an older investigation requires them

Answer

Disable DNS log ingestion entirely and rely on firewall logs to reconstruct DNS activity when needed

Answer

Export all DNS logs to an external cold-storage bucket immediately at ingestion and remove them from SecOps to reduce indexed volume