Cortex XDR Deletion

ldonahue — Fri, 28 Mar 2025 12:10:31 GMT

Hi,

We have endpoints that we are considering deleting from our Gateway. It is my understanding that this is mainly a cosmetic/license recovery action, but my question is regarding the data from that endpoint. I found this in the documentation

Data associated with the deleted endpoint is displayed in the Action Center tables and in the Causality View for the standard 90 days retention period.

I was wondering if after the 90 day retention period, all data from the endpoint is deleted? In the event that we need to run historical XQL queries, will data from that endpoint remain searchable, or is everything purged after the 90 day period?

Thank you

Re: Cortex XDR Deletion

jmazzeo — Fri, 28 Mar 2025 12:58:16 GMT

Hi @ldonahue, thanks for reaching us using the Live Community.

Any other endpoint data follows the standard data retention from this document: https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/License-Retention

31-day Ingested Data
186-day Alert and Incident Data

If this post answers your question, please mark it as the solution.

topic Cortex XDR Deletion in Cortex XDR Discussions

Cortex XDR Deletion

Re: Cortex XDR Deletion