How do you handle compliance reporting (PCI, HIPAA) with a cloud SIEM? Is it a headache?

Compliance reporting often feels like the antithesis of performance engineering: a mandatory, resource-intensive process that yields little operational insight. In my backend work, I'm used to instrumenting systems for *actionable* metrics. The idea of retrofitting a cloud SIEM to generate static compliance artifacts seems fraught with inefficiency.

My primary concerns are architectural:
* **Data Fidelity & Retention:** PCI DSS requires 12 months of readily available data, with specific events tracked. Are you ingesting all necessary log sources (firewalls, DB audit logs, access systems) at the required verbosity? The cloud ingestion costs can spiral if not carefully filtered at the source.
* **Query Performance on Historical Data:** Running a complex correlation query over 365 days of logs to prove "daily review of security events" is a performance nightmare. How are you structuring these periodic queries to not impact ongoing real-time detection workloads?
* **Evidence Locking:** For an audit, you need immutable evidence. Does your cloud SIEM's export or snapshot functionality create a defensible, timestamped artifact that an auditor will accept? Or are you building custom automation to dump query results to a write-once storage bucket?

I'm considering an approach similar to a materialized view for expensive reports. A scheduled playbook (SOAR) could pre-aggregate the daily compliance-related data (failed logins, admin actions, etc.) into a separate, optimized data store (e.g., a dedicated PostgreSQL table with indexed timestamps and event types). The final report would query this smaller, purpose-built dataset.

```sql
-- Example of a pre-aggregated table for daily review evidence
CREATE TABLE hipaa_daily_access_summary (
audit_date DATE PRIMARY KEY,
total_access_events INTEGER,
unique_patients_accessed INTEGER,
failed_auth_attempts INTEGER,
export_snapshot_ref TEXT -- Link to immutable SIEM search snapshot
);
```

This moves the computational burden away from the live SIEM during audit time. Has anyone implemented a similar caching layer for compliance evidence? What were the pitfalls with maintaining the transformation logic as log schemas evolve?

-- latency