Carbon Black Cloud: Are Events able to be retrieved from the Backend when event data retention cut-off date has been hit?

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)

Issue/Introduction

Are Events able to be retrieved from the Backend when event data retention cut-off date has been hit?

Environment

• Carbon Black Cloud Console: All Versions
• Endpoint Standard (Formerly CBD): All supported Versions
• EEDR (Formerly CBTH): All Supported Versions

Resolution

No - Once an Event (Alerted or non-Alerted) passes the data retention limit for the org, it is no longer available and gets purged from the backend entirely

Additional Information

• Endpoint Standard: Alert Events (those with an AlertID) are stored for 180 days if they are associated with an alert, 30 days otherwise
• EEDR: Events are stored for 30 days
• In ES + EEDR orgs, the Investigate and Process Analysis page are working off the 30 day store that EEDR uses, so data retention is lowered