Retention Policy and Enforcement

Retention policy for Cortex XSOAR 8 SaaS.

Cortex XSOAR SaaS operates a retention policy for the following data:

• Incidents

  Incidents are retained for 6 months, by default, after the incident was created in Cortex XSOAR. For more information, see Incidents.

  If using an MSSP/Multi-tenant environment, each child tenant has 6 months of incident retention by default. For more information, see MSSP and Multi-Tenant Environments.
• Indicators (not yet enforced)

  Indicators will be limited according to your license. For more information, see Indicators.

Cortex XSOAR 8 SaaS incident retention policy

Cortex XSOAR SaaS includes an incident storage limit and a nominal retention charge for extended incident storage, which enables us to ensure the seamless availability of data and provide you with a reliable and efficient platform.

The incident retention policy is now being enforced for customers. Incident retention license add-ons can be purchased to extend the retention period.

Users can permanently retain up to 1000 specific incidents depending on their needs. The incident retention policy does not delete retained incidents, even after the 6-month retention period and any extension license period. Retaining an incident can be done for compliance or incident management reasons to ensure that the most valuable incidents are kept on the tenant and not deleted by retention enforcement or accidental removal.

The retention policy does not apply to users who migrated from Cortex XSOAR 6 or purchased Cortex XSOAR 8 before January 2024 until their license renewal. After which, the retention policy applies.

What is the default Cortex XSOAR 8 SaaS incident retention period?

The default retention period for Cortex XSOAR 8 SaaS incidents is 6 months.

How is Cortex XSOAR 8 SaaS incident retention calculated?

The incident retention period is calculated from when the incident was created in Cortex XSOAR.

Can I extend Cortex XSOAR 8 SaaS incident retention?

You can easily extend the retention period according to your needs by purchasing a retention extension add-on.

Where can I find my Cortex XSOAR retention entitlement?

The retention entitlement will be visible on the Cortex XSOAR license page Settings & Info → Cortex XSOAR License.

xsoar-license.png

Cortex XSOAR 8 SaaS MSSP and multi-tenant incident retention

By default, each child tenant retains incidents for 6 months. The retention period is calculated from when the incident was created in Cortex XSOAR.

You can purchase incident retention licenses to extend the incident retention of one or more child tenants. These licenses, once purchased, are available in the Cortex Gateway for allocation to child tenants. For more information, see Allocate incident retention licenses.

Note

Once an incident retention license has been assigned to a child tenant, the license cannot be removed from the child tenant or assigned to another child tenant via the Cortex Gateway. If you need to remove or reassign an incident retention license, contact Customer Support.

If you delete a child tenant, any incident retention licenses assigned to that tenant are returned to the main account and can be reallocated.

How do I assign incident retention licenses to a new child tenant?

You can assign retention licenses when creating a new child tenant.

child-retention.png

How do I assign incident retention licenses to an existing child tenant?

Users can manage child tenant retention licenses from Cortex Gateway.

license-activation-mt.png

When clicking Manage Incident Retention Licenses:

manage-retention.png

Cortex XSOAR 8 SaaS indicator retention limits

Unlike incidents, indicators in Cortex XSOAR will not have a time limit. We will limit the number of indicators per tenant as follows:

License	Indicators
XSOAR + TIM	Up to 100 million indicators
XSOAR (No TIM license)	Up to 3 million indicators

When will Palo Alto Networks enforce Cortex XSOAR 8 SaaS indicator limits?

Indicator retention enforcement is planned for 2025.

Can I increase my Cortex XSOAR indicator limit?

Customers with no TIM license can buy a TIM license and have up to 100 million indicators on their tenant. The number of indicators can’t exceed 100 million per tenant.

How does Cortex XSOAR delete indicators after reaching the limit?

The indicators will be deleted from older to newer (FIFO). Indicators that are linked to open incidents will not be deleted.