> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/learn-about-cortex-xsoar/data-retention-policy.md).

# Data retention policy

By default, Cortex XSOAR keeps incidents for six months. This retention policy is being gradually enforced from February 2024. The retention period is calculated from when the incident was created in Cortex XSOAR. For more information about the retention policy, see [Cortex XSOAR 8 Retention Policy FAQs](/cortex-xsoar-8-retention-policy/cortex-xsoar-8-retention-policy-faqs/readme.md).

{% hint style="info" %}

### Note

The retention policy does not apply to users who migrated from Cortex XSOAR 6 or purchased Cortex XSOAR 8 before January 2024 until their license renewal. After which, the retention policy applies.
{% endhint %}

If you need to store incidents for longer than six months to meet regulatory requirements, there are three options:

* Purchase retention licenses. For more information, contact Customer Support.
* Exclude up to 1000 incidents from the incident retention policy. Retained incidents are not deleted. If you reach 1000 retained incidents, you won't be able to exclude additional incidents from the retention policy, unless you disable incident retention for some or all of your existing retained incidents. For more information, see [Retain incidents](/cortex-xsoar-8-saas/investigate-and-respond-to-threats/incidents-and-indicators-investigation/investigate-an-incident/retain-incidents.md).
* Export incidents to external cloud storage. Exported incidents are sent to Amazon S3 or an S3-compatible storage solution. You can schedule incident exports or export incidents on demand. For more information, see [Export Cortex XSOAR incidents to cloud storage](/cortex-xsoar-8-saas/configure-cortex-xsoar/incident-configuration/export-cortex-xsoar-incidents-to-cloud-storage.md)

To view your incident retention period, go to **Settings & Info** → **Cortex XSOAR License**. The retention period includes any retention add-ons you have purchased. For example, if you have purchased an additional six months of retention, you see **12 Months of incidents retention (6 months default period + 6 months of paid licenses)**.

#### MSSP and multi-tenant

When you create a new child tenant, you can assign purchased retention licenses to the child tenant, from Cortex Gateway. You can also allocate retention licenses to existing child tenants. For more information, see [Allocate Incident Retention Licenses](/cortex-xsoar-8-saas/multi-tenant/onboard-cortex-xsoar-multi-tenant/step-3.-allocate-incident-retention-licenses.md).

#### Indicator retention

Indicators retention enforcement is planned for 2025.

The indicator retention policy is based on the total number of indicators stored.

| License                | Indicators                   |
| ---------------------- | ---------------------------- |
| XSOAR + TIM            | Up to 100 million indicators |
| XSOAR (No TIM license) | Up to 3 million indicators   |

If the indicator limit is reached, indicators are deleted from older to newer (first-in-first-out). Indicators that are linked to open incidents are not deleted.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/learn-about-cortex-xsoar/data-retention-policy.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.