Retention by plan
Search back 7 days on Free, 30 days on Detect, one year on Investigate, or one to five years on Enterprise.
Use case
Security log retention for Cloudflare investigations
Keep Cloudflare evidence available long enough to investigate incidents, support audits, and compare current behavior against history.
Capabilities
What Flarehawk gives this workflow
Each use case starts from Cloudflare telemetry and ends with evidence your team can use.
Searchable incident evidence
Retained logs stay useful for investigations, not just archived away from the analysts who need them.
Exports for audits
Use retained evidence and exports to support post-incident reviews and compliance workflows.
Workflow
From setup to investigation
The same core loop supports analytics, autonomous investigation, and retention-driven evidence review.
1
Cloudflare logs are ingested and normalized as they arrive.
2
Flarehawk stores log history according to the selected plan.
3
Analysts search retained events during investigations.
4
Vigil uses historical context to explain current alerts.
5
Teams export evidence when an audit or review requires it.
FAQ
Use-case questions
Why not only keep logs in cold storage?
Cold storage can be useful, but investigations move faster when evidence remains connected to detections, search, and incident context.
Can Enterprise retention be customized?
Yes. Enterprise is the right path when retention, volume, support, or MSP requirements need a custom agreement.