By default, Cortex XDR will store a minimum of 30 days for EDR data as stated in the documentation here.
There is no enforcement for alerts wrt time right now. Instead, it depends on the count of alerts (in millions). They will eventually disappear based on the number of alerts generated in the system, in a FIFO format. If there are regulatory/compliance requirements to store data, there are hot storage and cold storage SKU's to ensure data storage depending on the use case.
You can take a look at the Dataset Management table to see the current range of the data.
By default, Cortex XDR will store a minimum of 30 days for EDR data as stated in the documentation here.
There is no enforcement for alerts wrt time right now. Instead, it depends on the count of alerts (in millions). They will eventually disappear based on the number of alerts generated in the system, in a FIFO format. If there are regulatory/compliance requirements to store data, there are hot storage and cold storage SKU's to ensure data storage depending on the use case.
You can take a look at the Dataset Management table to see the current range of the data.
