Retention time for new datasets

[micomi]

Hi all

Does someone know which retention period is used for datasets created through correlation rule or scheduled query?

[jtalton]

Hi Micomi, 

For XQL Search capabilities, Cortex XDR enforces retention on all log-type datasets excluding Host Inventory, Vulnerability Assessment, Metrics, and Users. This includes Correlation rules. 

Cortex XDR Pro per Endpoint and Cortex XDR Cloud per Host

• 30-day Ingested Data
• 180-day Alert and Incident Data
• 365-day Forensic Data

Cortex XDR Pro per GB

• 30-day Ingested Data
• 180-day Alert and Incident Data

Incident and alert data are retained according to the last Update and Creation dates, respectively. Reference License Retention • Cortex XDR Pro Administrator Guide • Reader • Palo Alto Networks documentation p...

If you found this answer helpful please select Accept as Solution.

Thank you

[micomi]

Hi @jtalton 

Thanks for you answer. I read this documentation before. When I create a new dataset through correlation rule I get a dataset type "correlation". If creating a new dataset via XQL Query I get the type "user". By just reading the documentation I'm not sure if these types have any retention period set and if a retention period is set I don't know if it's 30 or 180 days.

[jtalton · Accepted solution]

Hi Micomi, 

The Correlation Rule data set falls under a custom dataset where the base license includes 30 days of hot retention for both endpoint data and Pro per GB data.

You may view a summary of current retention entitlements by navigating to Settings > Configurations > Dataset Management page.

Also, a new storage-based add-on license can be purchased per dataset with a Pro GB license in 30-day increments. You may reach out to your SE for additional questions. 

Reference "Flexible hot storage retention license" in the October 2023 Release notes

October 2023 • Cortex XDR Release Notes • Reader • Palo Alto Networks documentation portal

Thank you!