> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/learn-about-cortex-xdr-5.x/cortex-xdr-license-plan/data-retention-in-cortex-xdr.md).

# Data retention in Cortex XDR

Learn more about the default retention periods for all Cortex XDR licenses, and the available retention add-ons.

After purchasing your license retention add-ons, you can view details about your Cortex XDR licenses and retention add-ons by selecting **Settings** → **Cortex XDR License**. For more information on your storage license details, see Dataset Management.

**Default retention periods**

The following table summarizes the default retention periods:

| Data type                                 | Cortex XDR Prevent                                                                | <p>Cortex XDR per Endpoint</p><p>Cortex XDR Cloud per Host</p> | Cortex XDR per GB | Notes                                                                                                                                                                                                                                                                                                                               |
| ----------------------------------------- | --------------------------------------------------------------------------------- | :------------------------------------------------------------: | :---------------: | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Ingested data                             | N/A                                                                               |                             31 days                            |      31 days      |                                                                                                                                                                                                                                                                                                                                     |
| Case and Issue data                       | <p>186 days (min 200 endpoints)</p><p>Option to purchase additional retention</p> |                            186 days                            |      186 days     | Case and Issue data are retained according to the last Update and Creation dates, respectively. Data collected within these dates is kept and displayed for 186 days. To ensure the accuracy of Cases, Cortex XDR provides a grace period of up to 31 days for Issues displayed in the Cases View, Issues table, and Casualty View. |
| <p>Agentic AI chats and artifacts<br></p> | 186 days                                                                          |                            186 days                            |      186 days     | If you purchase a retention add-on to extend Case and Issue data, Agentic AI chats and artifacts are included in the extended retention.                                                                                                                                                                                            |
| Forensic data                             | N/A                                                                               |                            365 days                            |         –­        | Requires Forensics add-on                                                                                                                                                                                                                                                                                                           |
| Query data                                | <p>186 days</p><p>Option to purchase additional retention</p>                     |                            186 days                            |      186 days     |                                                                                                                                                                                                                                                                                                                                     |

**Retention add-ons**

To extend your storage, you can purchase one or more of the following retention add-ons:

| Retention add-ons                                                                                                                                                                                                               | Cortex XDR Prevent |                                                                                               <p>Cortex XDR per Endpoint</p><p>Cortex XDR Cloud per Host</p>                                                                                              |   Cortex XDR per GB   |
| ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | :----------------: | :-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------: | :-------------------: |
| Additional 31-day hot storage of Case and Issue data                                                                                                                                                                            |         –­         |                                                                                                                <p>✓</p><p>per endpoint</p>                                                                                                                | <p>✓</p><p>per GB</p> |
| <p>Period-based retention - hot storage</p><p>Fully searchable storage for investigation and threat hunting of ingested data, and Case and Issue data.</p>                                                                      |         –­         | <p>✓</p><p>Available separately for the Cortex XDR per Endpoint or Cortex XDR per Endpoint with XTH data licenses. Prices are dependent on whether XTH data has been purchased. Requires purchasing a minimum of 1 month of the additional retention.</p> |           ✓           |
| <p>Period-based retention - cold storage</p><p>Lower cost storage of ingested data for long-term compliance needs with limited search options.</p><p>Requires purchasing a minimum of 6 months of the additional retention.</p> |         –­         |                                    <p>✓</p><p>Available separately for the Cortex XDR per Endpoint or Cortex XDR per Endpoint with XTH data licenses. Prices are dependent on whether XTH data has been purchased.</p>                                    |           ✓           |


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/learn-about-cortex-xdr-5.x/cortex-xdr-license-plan/data-retention-in-cortex-xdr.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.