Detection quality collapses when the data does. Oliver keeps the full event history queryable at full resolution and runs entire rule packs in a single pass, so investigation is bounded by the question — not by what your SIEM tier let you retain.
SIEM economics force a choice between retention, speed, and cost. Noisy sources get sampled, older events get frozen into archives that are impractical to search, and rule packs run against a fraction of the stream. An analyst — or an agent — then reasons over what survived, and a hunt that should take minutes turns into a restore request.
Oliver recognizes OCSF on the way in and shapes it against your schema — class, category, severity, and actor as queryable dimensions, the message full‑text searchable, and the long tail preserved in attributes rather than dropped.
Full‑resolution events remain queryable across your retention window, with hot and object‑storage tiers controlling cost. Last quarter’s events answer at interactive speed instead of arriving as a restore ticket.
Detection packs compile into one pass over the data rather than one query per rule, so a whole rule library can be evaluated against a wide window and re‑run against history whenever a rule changes.
Every key carries a policy that is compiled into the query itself, so an investigating agent reaches exactly its lane — and every request it made is on the audit trail afterwards.