CB Response: What is the recommended number of days of data to retain?

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

What is the recommended number of days of data to retain?

Environment

• CB Response: All Versions

Resolution

30 days

Additional Information

• The number of days retained is a balance between the value of the data over time and the cost of data storage. 30 days allows for access to key information required for incident response and limits the amount of storage that is required. This also reduces performance impact on the backend.
• Days stored will increase the amount of data storage required and may impact the number of servers required to process the stored data. There is a performance degradation that occurs when the number of process documents stored exceeds the recommended number of days stored
• Use of cold storage is recommended if more than 30 days of storage is desired.