Too much Forensic Data

[RFeyertag]

Hello dear community, 

how do we delete the collected forensic data? Is there a option to do this? I was testing around with the forensics addon and collected from some agents, but now I want to get rid off.

Example Screenshot

Thanks

BR

Rob

[bbucao]

Hi RFeyertag,

There is currently no ability to manually remove this data. It will be removed from the console once the data ages out.

Regards,
Ben

[RFeyertag]

Hi @bbucao, 

what are the ages of forensic data, after it will be deleted?

BR

Rob

[mavraham · Accepted solution]

Hi @RFeyertag,

The retention policy for forensic data is 365 days. 

Source
https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Prevent-Administrator-Guide/Feature...

[bbucao · Accepted solution]

Hi RFeyertag,

Ingested and parsed forensic data is retained for 1 year.

Regards,
Ben

[RFeyertag]

@bbucao @mavraham 

Thank you very much for your feedback!

BR

Rob