For US federal government, "Office of Management and Budget" says to store 72 hours of packet capture, since 2021 (partially in response to SolarWinds attack). (M-21-31)

https://www.cisa.gov/sites/default/files/2023-02/TLP%20CLEAR...

I do that with very, very low traffic industrial automation systems.