Retention vs. Investigation on a Shared Log Platform

Yes - pay for the restore, and start it immediately.

• The regulator's clock is running. A 5-business-day restore against a regulatory inquiry is a real deadline risk; delaying the restore to 'decide later' only shortens the time to answer. The cost is a rounding error against a regulatory finding.
• Scope the restore precisely: request only the 11-week-ago window and the relevant identities/data stores, not the whole cold tier - reduces cost and turnaround.
• In parallel, preserve everything still in hot/cold before it ages out. The incident is near the 90-day cold boundary; logs older than that may be gone soon. Issue an internal preservation request now and snapshot the relevant indexes. Even without a formal litigation hold, a regulator inquiry is a preservation trigger for the data you still hold - loop Legal in immediately to decide whether a hold is warranted (they, not you, make that call).
• Reconstruct from other sources while the cold restore runs: DLP alerts, endpoint EDR telemetry, ERP/CRM access logs, badge/VPN data, email gateway. The SIEM is one source; the insider story can often be built from the others faster.
• Document the chain of custody for whatever you restore - the regulator will ask how it was handled.

Case for: insider exfil is exactly the scenario where packet data (actual file transfers, exfil destinations) is decisive; metadata alone can leave gaps a regulator or court will probe.

Case against: +4 TB/day nearly triples ingest cost, most of it low-value; full-packet capture is a broad privacy exposure (customer and employee traffic) that needs Legal/Privacy sign-off, not just a security decision; and it's a blunt instrument when targeted capture would do.

Recommendation: do not approve blanket full-packet capture. Approve targeted capture with conditions.

Conditions:

1. Scope to egress and sensitive-data paths only - capture at the boundary and around the customer-records systems, not the whole estate. This targets exfil without hoovering up all internal traffic.
2. Short retention (e.g., 14 days) with automatic purge - packet data is for live investigation, not archival; long retention multiplies privacy risk and cost.
3. Privacy/Legal review and a documented lawful basis before enabling; access restricted to named investigators with audit logging.
4. Cost gate: tie the added spend to a measured reduction in mean-time-to-answer for exfil cases; revisit in 90 days.

This gives the DLP team the evidence they actually need (exfil destinations, file contents in transit) at a fraction of the cost and privacy exposure of 4 TB/day of everything.

What changes: without a litigation hold, you are not yet under a court-imposed preservation duty - but a regulator inquiry is its own preservation trigger, and destroying or losing relevant records after you knew of the inquiry is the kind of thing that turns a bad answer into an aggravating one. So the practical obligation is the same: preserve what you have, now.

What I tell the CISO (plainly):

• 'No litigation hold' does not mean 'no duty to preserve.' It means Legal hasn't yet made the call - and that call is theirs, not ours. I am asking Legal today whether a hold is warranted; meanwhile I am preserving the relevant logs and evidence so we never have to explain a gap.
• I am not deleting anything relevant, and I am not broadening collection beyond what's needed - over-collection has its own privacy and cost problems.
• I am starting the cold restore now because the 5-day latency is the binding constraint, and I am documenting every preservation action with timestamps and owners.
• Decision needed from CISO: authorize the restore spend (recommended: yes) and route the packet-capture question to Legal/Privacy with my scoped recommendation attached.

Bottom line: act as if preservation matters, because it does; let Legal own the formal hold decision, and keep the audit trail clean either way.