Retention requirements depend on your compliance obligations and business needs. PCI DSS requires 12 months, but many organizations keep security logs for 2-7 years to support long-term threat hunting and forensic investigations.