> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/learn-about-cortex-xsiam/cortex-xsiam-product-licenses/data-retention.md). # Data retention After purchasing your license retention add-ons, you can view details about your Cortex XSIAM licenses and retention add-ons by selecting **Settings** → **Cortex XSIAM License**. For more information on your storage license details, see [Dataset Management](/cortex-xsiam/configure-cortex-xsiam/data-management/dataset-management.md). **Default retention periods** The following table summarizes the default retention periods for Cortex XSIAM: | Data Type | Default Retention Period | | ------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Ingested data | 31 days | | Cases and Issues data |

186 days

Note

Case data is retained according to the Last Updated date.

Issue data is retained according to the Observation Time. Data collected within these dates is kept and displayed for 186 days. To ensure the accuracy of issues, Cortex XSIAM provides a grace period of up to 31 days for issues displayed in the Issues View, Issues table, and Cases View.

| | Agentic AI chats and artifacts | 186 days | | Forensic data |

365 days

Note

Requires the Forensics add-on.

| | Audit logs | 365 days | | Query data | 186 days | **Retention add-ons** Retention add-ons are provided for ingested data and Cases and Issues data. Minimum requirements are dependent on the license type. You can purchase one or more of the following add-ons: | Feature | Description | | --------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Additional Cases and Issues Retention |

An additional 31-day hot storage of Case and Issue data apart from the default 186 days.

Available for purchase per month for each endpoint. This retention add-on also extends agentic AI chats and artifacts retention by 31 days.

| | Period-Based Retention - Hot Storage (All datasets) |

Fully searchable storage for investigation and threat hunting of ingested data, and Cases and Issues data.

Requires purchasing a minimum of one month of the additional retention.

| | Additional Hot Storage (Selected datasets) |

Flexible hot storage-based retention to help accommodate varying storage requirements for different retention periods and datasets. Fully searchable storage for investigation and threat hunting of ingested data.

Available for purchase with storage for a minimum of 1,000 GB.

| | Period-Based Retention - Cold Storage |

Lower-cost storage of ingested data for long-term compliance needs with limited search options.

Requires purchasing a minimum of six months of additional retention.

| --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-xsiam/learn-about-cortex-xsiam/cortex-xsiam-product-licenses/data-retention.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.