The Archivist

First contact

It is usually met the same way. Someone asks for the logs of an incident, the logs are not there, and nobody can say how long that has been true. Then somebody in the room works out why, and says it almost with relief: “We did that on purpose.” They had.

Behaviour

It curates. Nothing it takes is broken on the way out. Entry is through a cost review: a workspace holding a hundred and eighty days of evidence, a decision that thirty will do, one number changed. That decision is reviewed. It is approved. It goes into the minutes with a name against it, and it saves about two hundred euros a month.

Nothing breaks. Nothing degrades. The estate goes on producing evidence at exactly the same rate and stops keeping any of it, and every health signal in the building reports that this is fine. By every measure those signals were built to take, it is.

Signs of infestation

Read the retention on every Log Analytics workspace against the figure your last assessment assumed. Where they differ, open the Activity Log to find when it changed and who changed it.

This is where it is met properly. The Activity Log keeps ninety days, and only ninety, unless somebody exported it to a workspace or a storage account that keeps longer. Check whether they did. Where they did not, and the cut happened outside that window, there is no record of the cut: it has eaten the evidence of its own arrival, and what is left is not a date but the fact that nothing can be seen past one.

Containment

The feeding can be stopped. Nothing else can. What has already been taken is not recoverable by any action available, and this is the part worth sitting with: where an intruder was active inside the lost window, that window can no longer be used to show they left. What is missing is the ability to say an incident ended.