topic Re: Too much Forensic Data in Cortex XDR Discussions

Too much Forensic Data

RFeyertag — Sat, 25 Feb 2023 00:27:29 GMT

Hello dear community,

how do we delete the collected forensic data? Is there a option to do this? I was testing around with the forensics addon and collected from some agents, but now I want to get rid off.

Example Screenshot

Thanks

Rob

Re: Too much Forensic Data

bbucao — Mon, 27 Feb 2023 16:48:51 GMT

Hi RFeyertag,

There is currently no ability to manually remove this data. It will be removed from the console once the data ages out.

Regards,
Ben

Re: Too much Forensic Data

RFeyertag — Wed, 01 Mar 2023 14:58:57 GMT

Hi @bbucao,

what are the ages of forensic data, after it will be deleted?

Rob

Re: Too much Forensic Data

mavraham — Wed, 01 Mar 2023 16:23:28 GMT

Hi @RFeyertag,

The retention policy for forensic data is 365 days.

Source
https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Prevent-Administrator-Guide/Features-by-License-Type

Re: Too much Forensic Data

bbucao — Wed, 01 Mar 2023 16:24:34 GMT

Hi RFeyertag,

Ingested and parsed forensic data is retained for 1 year.

Regards,
Ben

Re: Too much Forensic Data

RFeyertag — Wed, 01 Mar 2023 21:52:32 GMT

@bbucao @mavraham

Thank you very much for your feedback!

Rob