You can only hunt as far back as you keep
Retention is a detection control that usually gets decided on cost. Searchable retention and stored retention are different numbers.
Retention is a detection control. It is usually written down as a storage decision and signed off by someone comparing invoices.
The shape of the problem is simple. Dwell time for a quiet intrusion is routinely measured in weeks. Ninety day retention on the source that would answer your question is common, and thirty is not unusual. By the time the incident starts, the window you need sits behind the window you have.
Tiering makes it worse. Many platforms keep recent data hot and searchable, then roll older data into cheaper storage that is genuinely retained but not queryable without a restore measured in hours or days. “We keep a year” and “I can search a year right now, at two in the morning” are different claims, and only one of them helps during an incident.
Retention also varies per source in ways nobody has written down anywhere. Firewall at 30 days, endpoint at 90, authentication at 180. Your timeline stops at whichever source runs out first, and that is rarely the one you expected.
For each of your top five sources, write down two numbers: how long the data is retained, and how long it stays directly searchable. Where those numbers differ, the second one is your real lookback.
CHECK YOURSELF
Your platform retains 12 months of authentication logs, but only the most recent 30 days are in directly searchable storage. An investigation needs activity from four months ago. What is the honest description of your lookback?
SHOW THE ANSWER
30 days for immediate work, with older data available after a restore
Why. Saying 12 months promises an answer you cannot get in the first hours of an incident, and saying 30 days writes off data you actually hold. Both numbers are real and they answer different questions. Plan the live investigation around what you can query now, and start the restore immediately rather than at the point you discover you need it, because the restore is usually the long pole in the timeline.