Recovery Windows

When you connect a new tenant, Hal automatically reads back as much history as the source allows, up to the window below. No manual backfill step, and no ticket to raise.

How far back a source can go depends on each vendor’s API retention. Microsoft and Google each cap how far back their APIs will return events, and those caps are the hard ceiling on what Hal, or any SIEM, can ever read.

Per-source recovery windows

Log source	Recovery window	What this means
Microsoft 365 audit logs	6 days (vendor holds 7)	Microsoft’s Management Activity API keeps 7 days of content, and a blob that ages past 7 days mid-fetch is rejected, so Hal asks for 6 days and leaves the last day as a safety margin rather than race the expiry. After an outage or a failing credential Hal resumes from where he last read, within the 6 days.
Microsoft Graph sign-ins, directory audits, risk detections	29 days (vendor holds 30)	Graph paginates poorly at the very edge of its 30-day retention on busy tenants, so Hal stops a day short.
Google Workspace Reports + Alert Center	180 days	Google Workspace Reports API returns up to 6 months of activity. Alert Center matches. Hal pulls the full window.
CrowdStrike Falcon alerts	30 days on first connect	Hal’s own first-connect horizon: Falcon documents no retention window, and has returned alerts a month old. After an outage or a failing credential Hal resumes from where he last read, with a half-hour overlap, up to 30 days back.
1Password sign-in attempts, item usage, audit events	30 days on first connect	Hal’s own first-connect horizon; 1Password’s Events API reaches further back. After an outage or a token rotation Hal resumes each feed from where he last read, so the gap closes on the next cycle while 1Password still holds those events.
Zendesk tickets	7 days on first connect	A week of tickets is searchable from the start: triage reads from the cycle it starts in, and an investigation reads any older ticket live from Zendesk. After an outage the walk resumes from the newest update it had covered, with a few minutes’ overlap, so nothing in between is missed.
Windows endpoints and network devices	None	These ship logs to Hal as they happen. There is no vendor archive to ask for, so time the shipper or the device was not sending is not recoverable.

The Microsoft and Google ceilings are vendor limits, not Hal limits: events older than a vendor’s window cannot be retrieved from any tool using the standard audit APIs. Hal’s first read stops at a fixed margin inside them: the full window for Google, a day short on both Microsoft sources so nothing can age out mid-fetch. For CrowdStrike Falcon, 1Password and Zendesk the first-connect horizon is Hal’s own.

What happens on first connect

When Hal sees a source for the first time, the first ingest cycle reads the full window above, backwards from now:

A new Microsoft 365 tenant → the last 6 days, within the first cycle (typically minutes after the credential is saved).
A new Google Workspace tenant → the last 180 days.
A new Graph connection → the last 29 days.

There is no “ingest only forward from now” path on first connect. Adding the credential is the only step; you do not ask for a backfill or click a “fetch history” button.

How ingest stays current after the initial cycle

Once the first read is done, Hal polls each connected source on a continuous loop. Every cycle asks the vendor API for events since the cycle before it, typically a few minutes’ worth of new activity per source.

The polling is cursor-driven. Hal records when he last polled each source and asks for everything since then, with a short overlap; a per-tenant ledger of events already stored drops the duplicates. Two consequences:

No duplicate ingestion. Events that already landed in Hal don’t come back, even if Hal restarts mid-cycle.
No missed events when a cycle does not run. If cycles are delayed or do not run at all, a service restart or scheduled maintenance, the next cycle’s “since last poll” window widens to cover the gap, up to the source’s window (6 days for Microsoft 365, 29 days for Graph, 180 days for Google Workspace, 30 days for CrowdStrike Falcon).

When a credential fails

When a source’s credential expires or is revoked, the source shows as failing on the portal’s Logs page and in Hal’s health alert. Every source Hal reads from a vendor’s API holds its place while it fails: once the credential works again, Hal reads the whole stretch back, within the source’s window. Microsoft 365, Google Workspace, CrowdStrike Falcon, 1Password and Zendesk catch up on the next cycle, and Microsoft Graph over the following hours, two hours of events a cycle.

What the vendor no longer holds cannot be read back, by Hal or anyone, so fix a failing credential inside its source’s window. Microsoft 365’s is the shortest: a credential failing for longer than 6 days loses the part of the stretch older than that.

When data is unrecoverable

Events that age out of a vendor’s API before Hal reads them are gone. If cycles do not run for longer than a source’s window, the next cycle reads only the window: after 10 days, the last 6 days of Microsoft 365 audit; after 45 days, the last 29 days of Graph; after 200 days, the last 180 days of Google Workspace.

If you are intentionally taking a tenant out of operation for longer than its window (a long-running migration, decommissioning, a dispute), export anything you need before then with vendor-native tooling (Microsoft Purview eDiscovery, Google Workspace Vault, and so on). Hal cannot reach beyond the API window after the fact.

This is a Microsoft and Google API constraint that affects every SIEM and every audit-data consumer, and no third-party tooling works around it, other than continuously streaming audit logs to a separate destination the whole time, which is what Hal does for you while the connection is healthy.

Where to check current state

The Hal portal’s Logs page, under Sources, shows when each connected source last delivered events, and flags a source whose collection is failing.

Note

Summary: A first connect reads back up to 6 days of Microsoft 365, 29 days of Microsoft Graph and 180 days of Google Workspace, vendor API limits Hal stops a day short of on Microsoft’s, and 30 days of CrowdStrike Falcon, 30 days of 1Password and a week of Zendesk, Hal’s own horizons. Cycles that did not run are caught up on the next one, and a stretch while a credential was failing once it works again, both within the window.