Data retention in Cortex Data Security

After purchasing license retention add-ons, you can view details about your Cortex Data Security license and retention add-ons by selecting Settings → Cortex Data Security License. For more information on your storage license details, see Dataset Management.

Default retention periods

The following table summarizes the default retention periods for the Cortex Data Security license:

Data type	Retention period	Notes
Ingested data	30 days
Case and Issue data	180 days	Case and Issue data are retained according to the last Update and Creation dates, respectively. Data collected within these dates is kept and displayed for 180 days. To ensure the accuracy of Cases, Cortex Data Security provides a grace period of up to 31 days for Issues displayed in the Issues View, Issues table, and Cases View.
Query data	186 days

Retention add-ons

To extend your storage, you can purchase one or more of the following retention add-ons:

Retention add-on	Description
Period-based retention - hot storage	Fully searchable storage for investigation and threat hunting of ingested data, and Case and Issue data, extended in monthly increments beyond the default.
Additional hot storage - dataset	Extends hot-storage retention for specific datasets rather than all ingested data, providing more granular control.
Period-based retention - cold storage	Lower-cost storage of ingested data for long-term compliance needs with limited search options. Requires purchasing a minimum of 6 months of the additional retention.
Case and Issue retention	Extends retention of Issues and Cases data beyond the default 180 days, in monthly increments.