- Nationwide Digital Forensic & Cyber Investigation Services
A security information and event management platform is the only place where endpoint, identity, network, and cloud evidence sit side by side. Whether it saves an investigation depends entirely on what was ingested, and on which retention tier that data now lives in.
| Question | One line answer |
|---|---|
| Is SIEM data admissible? | Yes, when export methodology, query, and time range are documented. |
| How far back can we search? | To the edge of the interactive tier; older data may need an archive restore job. |
| What is the most common gap? | A log source that was never onboarded, most often outbound proxy or a subsidiary tenant. |
| Can attackers tamper with the SIEM? | Administrative access allows deletion or rule changes, which is why access review is part of the investigation. |
| Does a SIEM replace host forensics? | No. It records what was sent to it, not what was left on the disk. |
| Who should run the queries? | An independent examiner, with the query text preserved alongside the results. |
| Term | What it means |
|---|---|
| SIEM | Security information and event management. A platform that ingests, normalizes, stores, and correlates logs from many sources. |
| Interactive retention | The period during which data can be queried directly without a restore operation. |
| Archive tier | Lower cost long term storage where data remains but must be restored or searched with a job before analysis. |
| Connector | The integration that ships a given log source into the platform. If it was never configured, the data does not exist there. |
| Normalization | Mapping different vendor log formats into a common schema so events can be correlated across sources. |
| Clock skew | Differences in system time between sources that produce false event ordering if not corrected. |
Every major platform now separates hot searchable storage from cheaper long term storage. The distinction matters because a business will often say it retains a year of logs when what it means is that a year of data exists in a tier that requires a paid restore job before anyone can query it.
| Platform | Typical default behavior | Long term option |
|---|---|---|
| Microsoft Sentinel | Analytics tier commonly 90 days interactive when Sentinel is enabled on the workspace | Extended interactive retention, auxiliary and archive tiers up to multi year, with search or restore jobs to query |
| Splunk | Configured per index, commonly 90 days in hot and warm buckets | Cold and frozen storage governed by the retention policy the organization set |
| Elastic Security | Index lifecycle policies, commonly 30 to 90 days in hot storage | Warm, cold, and frozen phases before deletion |
We will document what your platform actually holds for the incident window, and what needs to be exported before it expires.
The value of a SIEM in a breach is not storage. It is the ability to place one identity, one address, and one process in a single sequence across four or five different systems.
A suspicious sign in from an unusual location becomes conclusive when it lines up with process execution on a workstation seconds later.
A beaconing process is confirmed when firewall or proxy records show matching periodic outbound sessions to the same destination.
Mailbox access followed by virtual private network authentication from the same address demonstrates a single actor operating across boundaries.
Egress byte totals tested against an extortion demand help counsel evaluate whether an exfiltration claim is credible.
Because a SIEM stores copies shipped off the originating host, it also defeats two of the most common evidence problems in breach work: local log rollover and deliberate log clearing by the intruder.
Naming these gaps in the report is not a weakness. It is what allows counsel to argue confidently about the conclusions that are supported, and to avoid overcommitting to the ones that are not.
Document connected sources, retention per table, ingestion filters, and the earliest surviving record for each source.
Extend retention and export the incident window immediately, before archive transition or deletion policies act.
Preserve every query, time range, and result set so the analysis can be reproduced by another examiner.
Build a normalized cross source timeline with each entry citing the originating record.
Where a source is silent, determine whether the event did not occur or the source was simply not collecting.
Most environments discover during an incident that at least one decisive source was never connected or was filtered out at ingest.
Long term tiers usually require a restore or search job, with real time and cost implications during a live incident.
Detections depend on tuned rules. Valid credentials used during business hours frequently generate no alert at all.
It holds copies of what hosts reported. It cannot show deleted files, staging archives, or artifacts the host never sent.
| Factor | Original source logs | SIEM copy |
|---|---|---|
| Survives host wipe | No | Yes |
| Survives log clearing | No | Yes, for already forwarded events |
| Completeness | Full native detail | Subject to filtering and parsing |
| Cross source correlation | Manual and slow | Native strength |
| Retention | Until rollover | Contracted tiers, often longer |
| Best use | Deep artifact detail | Timeline construction and scope |
We work inside your existing platform or with exports from it, and we document the analysis so that another expert can follow every step. Where the platform is incomplete, we say so and identify the alternate sources that fill the gap.
A written inventory of what your platform holds for the incident window, and what will expire and when.
Guidance and hands on support to preserve data before archive transition or deletion policies act.
A normalized reconstruction spanning identity, endpoint, network, and cloud evidence.
Egress and access analysis to evaluate extortion claims and inform notification scope.
Review of an internal or vendor produced timeline, including the questions it did not ask.
Court qualified examiners who can explain platform mechanics, retention tiers, and their limits to a lay audience.
Consultations are confidential. We work directly with affected businesses, with outside counsel, and with cyber insurance carriers and brokers nationwide.
Elite Digital Forensics is an independent digital forensics firm serving businesses, attorneys, and insurers nationwide. Our examiners include former law enforcement forensic examiners who have testified as court qualified expert witnesses in state and federal proceedings. We do not sell security software and we do not manage client networks, so our findings carry no conflict of interest when the question is whether an environment was adequately secured.
Every engagement follows documented chain of custody, defensible acquisition methods, and reporting written for attorney review, insurer submission, regulator response, or courtroom use. Work performed at the direction of counsel is generally treated as attorney work product prepared in anticipation of litigation. Call (833) 292-3733 or request a confidential consultation.
Analytics tier data is commonly interactively retained for 90 days when Sentinel is enabled on the workspace, with options to extend interactive retention and to hold data far longer in auxiliary or archive tiers. Archived data generally requires a search or restore job before it can be analyzed.
Yes. They are typically treated as business records generated by an automated system. What matters is documenting the export process, the exact queries and time ranges used, and the integrity of the exported data.
A decisive log source that was never onboarded. Outbound web proxy logs, virtual private network authentication, and tenants belonging to subsidiaries or acquired companies are the omissions we see most often.
They can assist, but where the adequacy of monitoring is itself in dispute, an independent examiner should design and document the queries so the results are not vulnerable to a claim of selective analysis.
It can provide strong supporting evidence through egress volume, destination, and access records. Definitive proof usually requires correlation with endpoint staging artifacts and cloud provider access logs, and sometimes the honest answer is that available data neither confirms nor excludes it.
Check backups of the platform, upstream source systems that may still hold native logs, and any archive tier that still exists. Where nothing survives, the report should state the limitation clearly rather than infer conclusions the record cannot support.
This content is for educational and informational purposes only and does not constitute legal advice. Elite Digital Forensics provides independent digital forensic services and expert witness testimony; we do not provide legal representation. Every case is fact specific; outcomes depend on the evidence, jurisdiction, and counsel. Retain qualified legal counsel for advice about your matter.
Elite Digital Forensics Assistant
By submitting this form, you consent to be contacted by email, text, or phone. Your information is kept secure and confidential. Reply Stop to opt out at anytime.
IMPORTANT: Please remember to check your spam or junk folder