QuestionQ124Verified/Policy ApplicationCopy linkReport a problemAsk AstroTutorSave questionWhy is it important to understand your company's event-data retention limits in the Falcon platform?AThis is not necessary; you simply select "All Time" in your query to search all dataBYou will not be able to search event data into the past beyond your retention periodCData such as process records are kept for a shorter time than event dataDYour query will require you to specify the data pool associated with the date you wish to searchShow AnswerAnswerExplanationEvent searches can retrieve data only while it remains within the organization’s configured retention period. Historical event data that has passed that period is no longer searchable.Show comments0Show commentsCommunity DiscussionNo comments yet. Be the first to start the discussion!
Community Discussion