War-game a log retention cut by testing whether shorter windows, export paths, and legal holds still protect incident replay when storage cost is high and a security review arrives late.
Retention cuts fail when "low value logs" is undefined, when exceptions dual-count the same stream as archived and as deleted, and when legal hold drills live only as a promise. The review needs one written map of streams by purpose, one owner who can deny a cut, and a documented consequence when a needed line is already gone.
Freeze the retention proposal
Write the current and proposed windows by stream, required evidence for each cut, approvers, notification list, and export or cold-store requirements. Attach the last five incidents that needed older logs, any open audit findings, and measured storage cost by stream. Identify exclusions in plain language. If a class of log is omitted from the proposal, show how that omission affects risk rather than leaving it as a footnote.
Name the approval choice and the conditions that force a hold. Include the ticket fields that compute eligibility so two reviewers can reproduce the same allow or deny label from the same packet.
Seat the cut from both sides
- Finance partner
- Defends why storage spend must fall and what burn the delay would cause.
- Security lead
- Challenges forensic gaps, hold coverage, and whether the cut reuses an untested archive path.
- Observability lead
- Tests stream identity, query usefulness, and whether the cut bypasses required incident windows.
- Compliance owner
- Checks whether regulatory and customer commitments match the claimed retention.
- Skeptic
- Finds the strongest cost claim with the weakest replay evidence.
Run pressure cases on the cut form
Use Pingpong to walk through a near-miss "tiny debug" stream, a partner audit that arrives after the new window, a security incident that needs thirty days of auth logs, and a request to waive the cold export because staging already looked fine. For each case, start from the documented proposal language. Ask who can expand the window and which evidence is required to reverse a deny. Any step that depends on an unnamed person becomes a retention condition.
Ask the room to replay one historical incident under the proposed windows. If the historical case would have lost the decisive lines, revise the cut before treating it as standard.
Compare the proposal with the observability lead seat and an audit log retention stress test. If data retention policy is broader, review a data retention policy stress test. More operating decisions live in the war-game decisions hub.
Publish the shorter window only after a dry run can reproduce the same allow or deny label from the stored ticket fields without manual reinterpretation.