Carbon Black Cloud: Are Events able to be retrieved from the Backend when event data retention cut-off date has been hit?
book
Article ID: 289898
calendar_today
Updated On:
Products
Carbon Black Cloud Endpoint Standard (formerly Cb Defense)
Issue/Introduction
Are Events able to be retrieved from the Backend when event data retention cut-off date has been hit?
Environment
Carbon Black Cloud Console: All Versions
Endpoint Standard (Formerly CBD): All supported Versions
EEDR (Formerly CBTH): All Supported Versions
Resolution
No - Once an Event (Alerted or non-Alerted) passes the data retention limit for the org, it is no longer available and gets purged from the backend entirely
Additional Information
Endpoint Standard: Alert Events (those with an AlertID) are stored for 180 days if they are associated with an alert, 30 days otherwise
EEDR: Events are stored for 30 days
In ES + EEDR orgs, the Investigate and Process Analysis page are working off the 30 day store that EEDR uses, so data retention is lowered