Disable Log Retention Controls

A subject disables or materially weakens controls intended to preserve logs for a defined period, causing records to expire, become unavailable, or lose protected status before they are likely to be reviewed.

The subject may shorten a retention period, remove an event source from archival storage, disable object lock or immutability, alter storage lifecycle rules, reduce repository capacity, change index-retention settings, or remove a protected logging tier. The configuration change may affect future records or accelerate the removal of records already held within a managed platform.

Investigators should review retention-policy history, lifecycle-rule changes, storage configuration, object-lock status, privileged access, change approvals, archive coverage, and the oldest available record for each expected source.