> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-retention-policy/cortex-xsoar-8-retention-policy-faqs/readme.md). # Retention Policy and Enforcement Cortex XSOAR SaaS operates a retention policy for the following data: * Incidents Incidents are retained for 6 months, by default, after the incident was created in Cortex XSOAR. For more information, see [Incidents](#incidents). If using an MSSP/Multi-tenant environment, each child tenant has 6 months of incident retention by default. For more information, see [MSSP and Multi-Tenant Environments](#mssp-and-multi-tenant-environments). * Indicators (not yet enforced) Indicators will be limited according to your license. For more information, see [Indicators](#indicators). ### Incidents Cortex XSOAR SaaS includes an incident storage limit and a nominal retention charge for extended incident storage, which enables us to ensure the seamless availability of data and provide you with a reliable and efficient platform. The incident retention policy is now being enforced for customers. Incident retention license add-ons can be purchased to extend the retention period. Users can permanently retain up to 1000 specific incidents depending on their needs. The incident retention policy does not delete retained incidents, even after the 6-month retention period and any extension license period. Retaining an incident can be done for compliance or incident management reasons to ensure that the most valuable incidents are kept on the tenant and not deleted by retention enforcement or accidental removal. {% hint style="info" %} ### Note The retention policy does not apply to users who migrated from Cortex XSOAR 6 or purchased Cortex XSOAR 8 before January 2024 until their license renewal. After which, the retention policy applies. {% endhint %} #### What is the default retention period for my Cortex XSOAR tenant? The default retention period for Cortex XSOAR incidents is 6 months. #### How is the retention period calculated? The incident retention period is calculated from when the incident was created in Cortex XSOAR. #### Can I extend the retention period? You can easily extend the retention period according to your needs by purchasing a retention extension add-on. #### Where can I find the tenant’s retention entitlement? The retention entitlement will be visible on the Cortex XSOAR license page **Settings & Info** → **Cortex XSOAR License**. ![xsoar-license.png](/files/Kp4CBBQBm2dSMeqW6tCV) ### MSSP and Multi-Tenant Environments By default, each child tenant retains incidents for 6 months. The retention period is calculated from when the incident was created in Cortex XSOAR. You can purchase incident retention licenses to extend the incident retention of one or more child tenants. These licenses, once purchased, are available in the Cortex Gateway for allocation to child tenants. For more information, see [Allocate incident retention licenses](/cortex-xsoar-8-saas/multi-tenant/onboard-cortex-xsoar-multi-tenant/step-3.-allocate-incident-retention-licenses.md). {% hint style="info" %} ### Note Once an incident retention license has been assigned to a child tenant, the license cannot be removed from the child tenant or assigned to another child tenant via the Cortex Gateway. If you need to remove or reassign an incident retention license, contact Customer Support. If you delete a child tenant, any incident retention licenses assigned to that tenant are returned to the main account and can be reallocated. {% endhint %} #### How do I assign retention licenses to a new child tenant? You can assign retention licenses when creating a new child tenant. ![child-retention.png](/files/OOV0hXKYP3ZaJnayoVsS) #### How do I assign retention licenses to an existing child tenant? Users can manage child tenant retention licenses from Cortex Gateway. ![license-activation-mt.png](/files/cUjespz0k7j6JvFy33fI) When clicking Manage Incident Retention Licenses: ![manage-retention.png](/files/bDgf5W9fSTsb9S9E8tXl) ### Indicators Unlike incidents, indicators in Cortex XSOAR will not have a time limit. We will limit the number of indicators per tenant as follows: | License | Indicators | | ---------------------- | ---------------------------- | | XSOAR + TIM | Up to 100 million indicators | | XSOAR (No TIM license) | Up to 3 million indicators | #### When will Palo Alto Networks start to enforce indicators retention? Indicators retention enforcement is planned for 2025. #### Can the number of indicators on my tenant be expanded? Customers with no TIM license can buy a TIM license and have up to 100 million indicators on their tenant. The number of indicators can’t exceed 100 million per tenant. #### How will indicators be deleted when the limit has been exceeded? The indicators will be deleted from older to newer (FIFO). Indicators that are linked to open incidents will not be deleted. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-retention-policy/cortex-xsoar-8-retention-policy-faqs/readme.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.