Archives and rehydration

Copy logs to object storage, and bring them back when you need to search them again.

1 min read Updated Oct 21, 2026 Sentinel Platform Team

logsarchivess3compliance

What an archive does #

Archiving copies logs to object storage in your own bucket. Archived logs stay searchable through Sentinel, and you keep the copy outside the platform.

Archiving is configured independently of your log indexes. An archive matches logs with its own filter and its own schedule, so you can archive a different set from the one you search live.

Supported destinations #

Amazon S3
Google Cloud Storage
Azure Blob Storage

Configuring a destination #

Add the destination under Logs → Archives, giving it a name, a bucket and credentials that can write to it.

Destination

{
  "name": "compliance-bucket",
  "provider": "s3",
  "bucket": "acme-logs-eu",
  "region": "eu-central-1",
  "endpoint": null,
  "prefix": "sentinel/logs",
  "credentials": {
    "access_key_id": "AKIA...",
    "secret_access_key": "..."
  }
}

Credential handling #

The secret half of a credential is encrypted before it is stored, under a key the platform operator holds. It is never written in plain text, and rotating the operator key re-encrypts stored credentials under the new version.

Use a dedicated bucket with its own policy. The credential needs write access to that bucket only, which keeps the blast radius of a leaked key small.

Archive rules #

A rule selects which logs are archived and how long they are kept there.

Filter — which logs are copied.
Retention — how long the archived copy is kept.
Schedule — how often the copy runs.

Archive status #

Each destination reports its own state, so you can tell a healthy archive from one that has stopped.

Last successful run — when the most recent copy completed.
Records archived — how many logs have been copied.
Bytes archived — the volume copied.
Gap start and end — the window covered by any gap, so you know what to expect to be missing.

A gap is recorded, not hidden

If an archive run cannot write, the affected window is recorded on the destination. Check the gap range before you rely on the archive for a compliance window.

Searching an archive #

Rehydration makes an archived window searchable again. Open the archive, choose the time range, and the matching logs are loaded for search.

Rehydration covers a time range, not a whole archive.
A wide range takes longer and costs more than a narrow one.
Rehydrated logs are searchable for a limited window and are not re-archived.

Operating an archive #

Check the last successful run when you set an archive up, and again periodically.
Alert on a gap range appearing — it means data is genuinely missing.
Rotate the access key in your bucket and update the destination when you rotate it there.
Match the archive retention to your compliance requirement before you enable it.