How Long Are Alerts and Events Kept?

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)
• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

How long are Events and Alerts able to be seen and reviewed in the Console?

Environment

• Carbon Black Cloud Console: All Versions

Resolution

• Alerts and the Events linked to them are stored for 180 days.
• Events not associated with any Alerts are stored for 30 days.
• Watchlist hits are stored for 30 days like Events not associated with Alerts.

Additional Information

• Increased data retention is available as an add-on product through VMware Data Retention for VMware Carbon Black Cloud.
• These retention settings were implemented in the August '16 release (0.18.x) of the Carbon Black Cloud Console.