Alerts retention duration in Cortex XDR

[rediaz]

Hi !

Does anyone know how long alerts/incidents will be visible in Cortex XDR ?

In our tenant we have alerts older than 1 year and I was wondering if they disappear after some time or if they will be accessible forever but I can't find this information anywhere.

Thanks

[bbarmanroy · Accepted solution]

By default, Cortex XDR will store a minimum of 30 days for EDR data as stated in the documentation here.

There is no enforcement for alerts wrt time right now. Instead,  it depends on the count of alerts (in millions). They will eventually disappear based on the number of alerts generated in the system, in a FIFO format. If there are regulatory/compliance requirements to store data, there are hot storage and cold storage SKU's to ensure data storage depending on the use case.

You can take a look at the Dataset Management table to see the current range of the data.