Wazuh Log Retention Strategy: ISM Policies, Hot/Warm/Cold and Compliance

Most Wazuh deployments fail their first audit not because they had no logs, but because they had no policy. This guide builds a defensible retention strategy that scales with ingest and aligns with the major compliance regimes.

Start from compliance, work backwards

• PCI-DSS: 1 year minimum, 3 months immediately accessible.
• HIPAA: 6 years.
• SOC 2: typically 1 year + 90 days online (CC7.2 evidence).
• ISO 27001: defined in policy, pick 1 year as a safe floor.

Hot / Warm / Cold tiers

OpenSearch ISM lets you age data across nodes with different storage profiles. A practical default:

• Hot (0-7 days): NVMe SSD, replicas=1, fully searchable in dashboard.
• Warm (7-30 days): SSD, replicas=0, still searchable but slower.
• Cold / snapshot (30 days - 1 year): S3 / object storage, restored on demand.

Example ISM policy

{
  "policy": {
    "description": "Wazuh alerts hot-warm-cold",
    "default_state": "hot",
    "states": [
      { "name": "hot",
        "actions": [{ "rollover": { "min_index_age": "1d", "min_size": "40gb" } }],
        "transitions": [{ "state_name": "warm", "conditions": { "min_index_age": "7d" } }] },
      { "name": "warm",
        "actions": [{ "replica_count": { "number_of_replicas": 0 } },
                    { "force_merge": { "max_num_segments": 1 } }],
        "transitions": [{ "state_name": "snapshot", "conditions": { "min_index_age": "30d" } }] },
      { "name": "snapshot",
        "actions": [{ "snapshot": { "repository": "s3_backup", "snapshot": "wazuh-alerts" } },
                    { "delete": {} }] }
    ],
    "ism_template": [{ "index_patterns": ["wazuh-alerts-*"], "priority": 100 }]
  }
}

Snapshots to S3

Register an S3 repository on the indexer and use the snapshot lifecycle (SLM) to push daily snapshots. Object storage is roughly 10x cheaper per GB than hot SSD, so cold storage is what makes 1-year retention affordable.

Sizing rule of thumb

Plan for ~0.4 GB per GB ingested per day on the indexer once replicas + overhead are counted. Snapshots compress to ~0.15 GB per GB. So 100 GB/day ingest = ~40 GB hot/day + ~15 GB snapshot/day.

Make audits painless

Export the ISM policy JSON, snapshot schedule and a sample restored search as evidence. Auditors care that the policy exists, is enforced, and that you can produce data from 11 months ago on request.