topic Re: Retention time for new datasets in Cortex XDR Discussions

Retention time for new datasets

micomi — Mon, 27 Nov 2023 15:41:45 GMT

Hi all

Does someone know which retention period is used for datasets created through correlation rule or scheduled query?

Re: Retention time for new datasets

jtalton — Mon, 27 Nov 2023 22:52:47 GMT

Hi Micomi,

For XQL Search capabilities, Cortex XDR enforces retention on all log-type datasets excluding Host Inventory, Vulnerability Assessment, Metrics, and Users. This includes Correlation rules.

Cortex XDR Pro per Endpoint and Cortex XDR Cloud per Host

30-day Ingested Data
180-day Alert and Incident Data
365-day Forensic Data

Cortex XDR Pro per GB

30-day Ingested Data
180-day Alert and Incident Data

Incident and alert data are retained according to the last Update and Creation dates, respectively. Reference License Retention • Cortex XDR Pro Administrator Guide • Reader • Palo Alto Networks documentation portal

If you found this answer helpful please select Accept as Solution.

Thank you

Re: Retention time for new datasets

micomi — Tue, 28 Nov 2023 07:35:36 GMT

Hi @jtalton

Thanks for you answer. I read this documentation before. When I create a new dataset through correlation rule I get a dataset type "correlation". If creating a new dataset via XQL Query I get the type "user". By just reading the documentation I'm not sure if these types have any retention period set and if a retention period is set I don't know if it's 30 or 180 days.

Re: Retention time for new datasets

jtalton — Tue, 28 Nov 2023 15:30:34 GMT

Hi Micomi,

The Correlation Rule data set falls under a custom dataset where the base license includes 30 days of hot retention for both endpoint data and Pro per GB data.

You may view a summary of current retention entitlements by navigating to Settings > Configurations > Dataset Management page.

Also, a new storage-based add-on license can be purchased per dataset with a Pro GB license in 30-day increments. You may reach out to your SE for additional questions.

Reference "Flexible hot storage retention license" in the October 2023 Release notes

October 2023 • Cortex XDR Release Notes • Reader • Palo Alto Networks documentation portal

Thank you!