FortiSIEM - Compliance Reporting – Report for Log Retention in ClickHouse and Archive
Hello everyone,
for our compliance reporting, we need a reliable report that shows whether and when log retention has taken place in ClickHouse and/or in the archive.
We already checked some existing reports, but in our environment they are currently empty and do not return any useful data. In addition, we are not fully sure whether the correct event types or system events are being used there to capture retention activities.
Therefore, we would like to ask the following:
How can such a report be implemented in a technically clean and reliable way?
Which event types are relevant for tracking retention activities?
Are there any best practices to provide an audit-proof / compliance-ready record of retention in ClickHouse and in the archive?
Are the standard reports sufficient for this, or is a custom report / custom query required?
Our goal is to achieve a transparent and auditable view of retention activities for compliance and audit purposes.
Thank you in advance for your support.
Best regards,
Alex