How Long Are Alerts and Events Kept?
search cancel

How Long Are Alerts and Events Kept?

book

Article ID: 291060

calendar_today

Updated On:

Products

Carbon Black Cloud Endpoint Standard (formerly Cb Defense) Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

How long are Events and Alerts able to be seen and reviewed in the Console?

Environment

  • Carbon Black Cloud Console: All Versions

Resolution

  • Alerts and the Events linked to them are stored for 180 days.
  • Events not associated with any Alerts are stored for 30 days.
  • Watchlist hits are stored for 30 days like Events not associated with Alerts.

Additional Information

  • Increased data retention is available as an add-on product through VMware Data Retention for VMware Carbon Black Cloud.
  • These retention settings were implemented in the August '16 release (0.18.x) of the Carbon Black Cloud Console.