This depends on your specific use cases, but many teams find that 90 days of full-resolution data covers most correlation and root cause analysis needs. The key is avoiding forced trade-offs between retention and cost that leave you blind during critical investigations.