What is data retention in Google SecOps?

Data retention refers to how long ingested telemetry remains available for search, detection, and retroactive analysis in Google SecOps, with standard offerings including 12 months of "hot" (immediately searchable) data retention by default at no additional cost beyond standard ingestion pricing.

Long retention specifically enables retroactive matching: when a new indicator of compromise (IOC) or detection rule is introduced, Google SecOps can apply it against months of already-ingested historical data to check whether a newly discovered threat was actually present in the environment earlier, which is a capability that's much harder to offer economically in a system where extended log retention is prohibitively expensive.

Beyond the platform's own hot storage, Google SecOps also supports exporting data to BigQuery, with free storage for that exported data up to the customer's retention period, which lets teams run additional long-term analytics, custom reporting, or extended-retention compliance use cases outside the core SecOps search experience itself.