Enable Dataset Storage Retention

[R.Christie699701]

How does one determine what datasets are stored in Hot Storage? 

I understand that a Hot Storage License dictates the length that data is retained, but what about determining what datasets retain data to begin with? 

For example: 

Furthermore, I am confused as to why the 'Last Updated' column is populated, and the 'Total Days Stored' column is not. 

Any insight is greatly appreciated. Cheers. 

[nsinghvirk]

Hello @R.Christie699701 ,

Thanks for reaching out on LiveCommunity.

With a regular Cortex XDR license, the data is automatically sent to hot storage for the default retention period according to the license, typically 1 month. If you've purchased additional retention add-ons to extend the hot storage, this is added in monthly increments to the hot storage duration according to the license. For example, a Period-Based Retention - Hot Storage license enables you to extend all the data(All datasets according to your base license pro per endpoint/pro per GB) in hot storage for the number of months designated, while an Additional Hot Storage license provides flexible hot storage so you can extend only the data collected in specific datasets for the number of months designated. 

So you can only choose between datasets when you have additional hot storage license.

Total days stored may not be relevant because the storage database is a snapshot based database hence it stores all relevant data in a given time.

Please click Accept as Solution to acknowledge that the answer to your question has been provided.

[R.Christie699701]

Hi @nsinghvirk, 

Thank you for your response! 

I believe I am now able to wrap my head around licenses, and what gives you the ability to select which datasets are stored. 

To clarify the difference between the 'Last Updated' and 'Total Days Stored' columns:

• 'Last Updated' indicates the last time the dataset was refreshed and checked for new data. 
• 'Total Days Stored'  may be empty because there is no data to populate the dataset. If there is data inside this dataset, then the field will be populated with the number of days the data is stored since it was captured. The field will increment by one each day and stop at the maximum as dictated by retention period which is in turn decided by the Cortex XDR license. 

Is this correct? 

Cheers