Most teams aim for at least 30 days of hot retention to cover a full monthly business cycle and common security investigation windows. However, your specific needs depend on how often you need to perform historical comparisons during incidents.