Security Log Analytics carries the ArcSight Logger lineage. Logger has been the long-retention forensic log store for ArcSight ESM customers for two decades, providing the cold storage tier behind the hot SIEM. OpenText now ships that engine as Security Log Analytics, integrated natively with Core Threat Detection and Response (SaaS SIEM) and Enterprise Security Manager (on-prem SIEM). The product covers the long-retention half of the SOC, meaning hunt, post-incident investigation and compliance reporting on data older than the SIEM's hot retention.
Long retention is the load-bearing requirement. Hot SIEM economics break down at retention windows beyond 90 to 180 days, but compliance regimes routinely require 1, 3, or 7-year retention on security logs. Programs running hot SIEM only either pay punishing prices to extend retention or lose the data to compliance gaps. Security Log Analytics handles the long-retention tier economically, so the program keeps audit-ready data for hunt and investigation without inflating SIEM costs.
Hot detection runs in Core TDR or Enterprise Security Manager, and cold forensic data sits in Security Log Analytics. The boundary between the two is configurable per data class, so high-value classes (security events, IAM logs, sensitive application logs) stay hot longer while low-value or high-volume classes move to cold faster. Pairing hot SIEM with this cold tier gives forensic depth, and running hot SIEM alone means paying too much for too little retention.
Hot/cold boundary drift is how Security Log Analytics deployments fail. Programs that adopt the product without designing the ingestion-and-retention policy end up with everything in hot SIEM (defeating the purpose) or everything in cold storage (losing detection coverage). Implementation designs the data-class policy, deciding which logs go hot, which go cold, when the boundary moves, and how compliance retention windows map to operational tiers. Without that, the product becomes a backup tape of logs nobody queries.
Ideal use cases
- Long-retention forensic log storage paired with Core Threat Detection and Response or Enterprise Security Manager
- Compliance retention for SOC 2, HIPAA, PCI DSS, and SOX-aligned multi-year log retention
- Threat hunting on data older than hot SIEM windows
- Post-incident investigation and timeline reconstruction
- Cost-efficient log analytics across high-volume sources