How Long Are Alerts and Events Kept?
book
Article ID: 291060
calendar_today
Updated On:
Products
Carbon Black Cloud Endpoint Standard (formerly Cb Defense)
Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)
Issue/Introduction
How long are Events and Alerts able to be seen and reviewed in the Console?
Environment
- Carbon Black Cloud Console: All Versions
Resolution
- Alerts and the Events linked to them are stored for 180 days.
- Events not associated with any Alerts are stored for 30 days.
- Watchlist hits are stored for 30 days like Events not associated with Alerts.
Additional Information
- Increased data retention is available as an add-on product through VMware Data Retention for VMware Carbon Black Cloud.
- These retention settings were implemented in the August '16 release (0.18.x) of the Carbon Black Cloud Console.
Feedback
thumb_up
Yes
thumb_down
No