> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/readme/understand-cortex-xdr-license-plans/data-retention-in-cortex-xdr.md).

# Data retention in Cortex XDR

After purchasing your license retention add-ons, you can view details about your Cortex XDR licenses and retention add-ons by selecting **Settings** → **Cortex XDR License**. For more information on your storage license details, see Dataset Management.

**Default retention periods**

The following table summarizes the default retention periods:

| Data type           | Cortex XDR Prevent                                                                | <p>Cortex XDR per Endpoint</p><p>Cortex XDR Cloud per Host</p> | Cortex XDR per GB | Notes                                                                                                                                                                                                                                                                                                                               |
| ------------------- | --------------------------------------------------------------------------------- | :------------------------------------------------------------: | :---------------: | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Ingested data       | N/A                                                                               |                             31 days                            |      31 days      |                                                                                                                                                                                                                                                                                                                                     |
| Case and Issue data | <p>186 days (min 200 endpoints)</p><p>Option to purchase additional retention</p> |                            186 days                            |      186 days     | Case and Issue data are retained according to the last Update and Creation dates, respectively. Data collected within these dates is kept and displayed for 186 days. To ensure the accuracy of Cases, Cortex XDR provides a grace period of up to 31 days for Issues displayed in the Cases View, Issues table, and Casualty View. |
| Forensic data       | N/A                                                                               |                            365 days                            |         –­        | Requires Forensics add-on                                                                                                                                                                                                                                                                                                           |
| Query data          | <p>186 days</p><p>Option to purchase additional retention</p>                     |                            186 days                            |      186 days     |                                                                                                                                                                                                                                                                                                                                     |

**Retention add-ons**

To extend your storage, you can purchase one or more of the following retention add-ons:

| Retention add-ons                                                                                                                                                                                                               | Cortex XDR Prevent |                                                                                               <p>Cortex XDR per Endpoint</p><p>Cortex XDR Cloud per Host</p>                                                                                              |   Cortex XDR per GB   |
| ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | :----------------: | :-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------: | :-------------------: |
| Additional 31-day hot storage of Case and Issue data                                                                                                                                                                            |         –­         |                                                                                                                <p>✓</p><p>per endpoint</p>                                                                                                                | <p>✓</p><p>per GB</p> |
| <p>Period-based retention - hot storage</p><p>Fully searchable storage for investigation and threat hunting of ingested data, and Case and Issue data.</p>                                                                      |         –­         | <p>✓</p><p>Available separately for the Cortex XDR per Endpoint or Cortex XDR per Endpoint with XTH data licenses. Prices are dependent on whether XTH data has been purchased. Requires purchasing a minimum of 1 month of the additional retention.</p> |           ✓           |
| <p>Period-based retention - cold storage</p><p>Lower cost storage of ingested data for long-term compliance needs with limited search options.</p><p>Requires purchasing a minimum of 6 months of the additional retention.</p> |         –­         |                                    <p>✓</p><p>Available separately for the Cortex XDR per Endpoint or Cortex XDR per Endpoint with XTH data licenses. Prices are dependent on whether XTH data has been purchased.</p>                                    |           ✓           |


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/readme/understand-cortex-xdr-license-plans/data-retention-in-cortex-xdr.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.