Security data has different immediate detection and longer-term investigation needs. What should retention and storage-tier planning consider?

1. Retain nothing after ingestion
2. Put all data in the cheapest tier without checking detection support
3. Keep every secret forever in public logs
4. Query capabilities, access latency, retention obligations, and cost for each data category