Sophos Next-Gen SIEM Data Retention Add-on

Sophos Next-Gen SIEM Data Retention Add-on extends retention of supported security data beyond the standard 13 months. It complements an existing Next-Gen SIEM entitlement for companies needing events for later investigations or longer-term evidence. Options of three, five, seven or ten years are available.

Revisit earlier events later

When an investigation concerns events long ago, retained history helps check connections. This can also matter for audits requiring several years of evidence. The add-on extends the period for supported data; it does not automatically collect extra sources or restore events that are missing or were never captured.

Distinguish retention from subscription term

The multi-year option describes the intended data-retention period, which differs from the purchased subscription’s term. Processing depends on active entitlements and configured integrations. Data handling at contract end must be clarified against the applicable terms; a ten-year option does not provide a blanket promise of continued use after a subscription expires.

Match coverage to the SIEM base

The add-on requires Sophos Next-Gen SIEM. Licence quantity must match the corresponding SIEM base of users and servers. Selection depends on the required evidence period, existing platform and actual collection from relevant sources. With older log collectors, check whether complete long-term retention is supported or migration is necessary.

A longer history can support an evidence strategy. It replaces neither operational system backups nor assessment of which data should be stored for how long for legal and organisational reasons.