Alerts retention duration in Cortex XDR

rediaz — Thu, 21 Jul 2022 08:31:43 GMT

Hi !

Does anyone know how long alerts/incidents will be visible in Cortex XDR ?

In our tenant we have alerts older than 1 year and I was wondering if they disappear after some time or if they will be accessible forever but I can't find this information anywhere.

Thanks

Re: Alerts retention duration in Cortex XDR

bbarmanroy — Thu, 21 Jul 2022 09:43:18 GMT

By default, Cortex XDR will store a minimum of 30 days for EDR data as stated in the documentation here.

There is no enforcement for alerts wrt time right now. Instead, it depends on the count of alerts (in millions). They will eventually disappear based on the number of alerts generated in the system, in a FIFO format. If there are regulatory/compliance requirements to store data, there are hot storage and cold storage SKU's to ensure data storage depending on the use case.

You can take a look at the Dataset Management table to see the current range of the data.

topic Alerts retention duration in Cortex XDR in Cortex XDR Discussions

Alerts retention duration in Cortex XDR

Re: Alerts retention duration in Cortex XDR