What data is included in the "extended data retention" configuration?

Products

• Carbon Black Cloud Endpoint Standard
• Carbon Black Cloud Enterprise EDR

Issue/Introduction

What data is included when "extended data retention" is added to the Carbon Black Cloud console? Is the data retention retroactive, or from the point of purchase forward?

Environment

• Carbon Black Cloud Console: Current Version

Resolution

 The "extended data retention" applies to the following types:

• Events and Observations not associated with any alerts
• Events associated with watchlist hits

And this configuration is NOT retroactive, so extended retention starts at the time the configuration is applied to the Carbon Black Cloud ORG going forward.

Additional Information

The default retention settings are documented in this KB.