Daylight Gives MDR Customers Long-Term Data Retention and Searchability Without a SIEM

Daylight's new Agentic Security Data Lake gives MDR customers years of security telemetry retention and searchable access through a managed Security Data Lake service.

Daylight today announced the launch of Agentic Security Data Lake, a managed Security Data Lake service that gives Daylight MDR customers long-term retention, searchability, and historical investigation capabilities without the operational complexity of running a SIEM.

The Growing Challenge of Security Data Retention

Security teams today collect telemetry from a growing number of sources, including identity providers, cloud platforms, endpoints, SaaS applications, email systems, and security tools. As environments become more distributed, the volume of security telemetry continues to increase. Retaining security data is often the easy part. The challenge is making that data accessible when questions arise months or years later.

Historically, organizations relied on SIEM platforms to solve this problem. SIEMs became the system of record for security telemetry, centralizing data and making it searchable for investigations. But as telemetry volumes have grown, many organizations have discovered that maintaining the infrastructure required to ingest, store, index, and query that data can become increasingly expensive and operationally complex.

As a result, many security teams are looking for a simpler and more cost-effective way to retain security telemetry, search historical activity, and answer questions when they arise.

Introducing Agentic Security Data Lake

Agentic Security Data Lake was built to address that need.

Available exclusively to Daylight MDR customers, the service enables organizations to retain years of security telemetry and investigate historical activity whenever questions arise. Customers can search data across identity systems, cloud environments, endpoints, SaaS applications, email systems, network activity, and other telemetry sources collected through Daylight MDR.

Whether responding to an audit request, supporting a compliance review, investigating a historical security event, answering a legal inquiry, or resolving an operational question, customers can access retained telemetry without opening support tickets or operating their own SIEM infrastructure.

"Organizations need to retain security telemetry for compliance, audits, investigations, and operational visibility," said Hagai Shapira, co-founder and CEO of Daylight. "For many organizations, the challenge is not storing the data. The challenge is making it accessible without taking on the cost and complexity of operating a SIEM. Agentic Security Data Lake gives our MDR customers long-term retention and searchable access to their telemetry whenever questions arise."

Built for Long-Term Retention and Searchability

The service is built around a two-tier architecture designed to balance accessibility and cost.

Recent telemetry remains immediately searchable for ongoing investigations, while historical telemetry is retained in low-cost archival storage. Organizations can retain years of security history to support compliance, audit, legal, operational, and security requirements without paying to keep all data continuously searchable. When historical information is needed, archived telemetry can be rehydrated into searchable storage and investigated on demand.

Agentic Security Data Lake is designed to make retained data useful, not simply stored.

An Agentic Investigation Experience

Customers can interact with retained telemetry via a natural-language chat experience. Instead of requiring expertise in schemas, parsers, data structures, or query languages, users can ask questions about their data and explore results conversationally. Advanced users can also access retained telemetry directly through KQL.

Unlike traditional approaches that require extensive normalization and transformation before data becomes useful, Agentic Security Data Lake stores telemetry in its original format. Organizations do not need to predict future investigations, maintain normalization pipelines, or decide in advance which fields may become important later. The data remains available in its original form and can be searched and investigated whenever new questions emerge.

Extending Managed Security Operations

The launch expands Daylight's managed security operations platform beyond detection and response.

Daylight MDR continues to provide 24x7 detection, investigation, and response. Agentic Security Data Lake adds long-term retention, searchability, and historical investigations, giving organizations many of the capabilities that traditionally drove SIEM adoption while maintaining a simpler operating model.

Agentic Security Data Lake is not intended to replace every SIEM deployment. Instead, it is designed to provide the retention, searchability, and investigation capabilities many organizations need without requiring the operational complexity of a full SIEM platform.

Agentic Security Data Lake is available today for Daylight MDR customers.

About Daylight

Daylight is a managed security operations services company that combines AI agents and expert operators to deliver managed detection and response, threat hunting, managed phishing protection, AI security monitoring, and agentic security data services. Daylight helps organizations detect, investigate, and respond to threats without the complexity of building and operating a traditional SOC.