Events
Each organization has a retention tier of 30, 90, 180 or 365 days, chosen when the organization is created. The tier is the maximum and cannot be changed later; storage grows with it.
Under Settings › Data & privacy › Log retention you can give an organization a shorter window, or set a shorter default for every organization. Shortened windows take effect 24 hours after saving, and deleted telemetry cannot be recovered. The page shows, before you save, how many events the change would delete.
A legal hold suspends deletion for one organization, up to its tier.
Other data
| Data | Kept |
|---|---|
| Unparsed events | 14 days |
| Playbook run traces | 90 days |
| Notifications | 90 days |
| Baselines | 45 days |
| Audit log | 1 year |
| Alerts, cases, reports, tickets | Until deleted |
Retention applies to events and the data derived from them. Alerts, cases and tickets are not affected.
Disk
Plan disk for the events retention: see the sizing table under Requirements. Settings › System shows storage per table so you can see a full disk coming.
Data subject requests
Settings › Data & privacy › GDPR data exports builds an export of a tenant's data, or of everything that mentions one person, for an access request or a contract exit. For erasure requests, contact support.