Question

Your organization ingests approximately 4 TB/day of DNS resolver logs into Google SecOps. Compliance requires that all security-relevant data be searchable for 12 months, but a cost review shows DNS logs account for 60% of storage spend while rarely being queried beyond 30 days. The DNS logs are still occasionally needed for retrospective threat hunts against newly discovered IOCs. Which approach best balances cost, retention, and investigative needs?

Accepted Answer

Assign the DNS log source to a lower-cost, longer-retention data tier while keeping it ingested and searchable, aligning tier selection to query frequency and IOC retro-hunt needs

Answer

Stop ingesting DNS logs entirely and rely on curated detections that do not depend on DNS telemetry

Answer

Continue ingesting all DNS logs at the standard retention tier and accept the storage cost as a compliance requirement

Answer

Ingest DNS logs but configure a 30-day retention policy so the data is automatically deleted after the active-query window