Data and records Retention
Retention
Retention sets how long your workspace keeps each kind of record. Older records are deleted by a sweep that runs every hour.
Shortening a window deletes older records at the next sweep, within the hour. Records already sent to a SIEM are not affected. See Log streaming.
Who can do it
Every member can read the page. Saving needs Manage workspace settings (settings:manage), which only the Owner role holds. Everyone else sees "Changing retention needs the settings:manage permission." in the footer.
Change a window
- Open Settings › Data › Retention.
- Choose a window for each kind you want to change. Each list offers only the windows that kind allows.
- Choose Save. The page answers "Saved. The next sweep applies it."
The footer shows when the last sweep ran and how many rows it removed, or "Swept hourly. Not swept yet." before the first.
Changes are written to the audit log.
Every setting
| Setting | What it covers | Windows you can choose | Default |
|---|---|---|---|
| Content revealed and platform-admin entry | Every reveal of held content, and every platform-admin entry. | 7 years, 3653 days | 7 years |
| Audit and access | The rest of the audit log: changes and sign-ins. | 180 days, 1 year, 400 days, 2 years, 3 years, 7 years | 400 days |
| Alerts and issues | Alerts, and issues once resolved. | 30 days, 90 days, 180 days, 1 year, 2 years, 3 years | 1 year |
| Interactions and engine runs | Interactions and engine runs. An alert keeps the interaction it points at. | 7 days, 14 days, 30 days, 60 days, 90 days | 90 days |
| File events | AI tool files appearing and changing. | 30 days, 90 days, 180 days, 1 year, 2 years | 90 days |
| Fleet history | Machine events and fleet changes. | 30 days, 90 days, 180 days, 1 year, 2 years | 1 year |
| Connector records | Connection syncs and their changes. | 30 days, 90 days, 180 days, 1 year, 2 years | 180 days |
The list marks the default window with "(default)". Alerts and issues and Interactions and engine runs are the same values that Governance › Runs › Settings reads and writes. A value set there that is not one of these choices is shown as itself and kept until you change it.
The shortest window for Content revealed and platform-admin entry is seven years. It is the record a regulator or an employee may ask for, so it cannot be shortened.
When it goes wrong
- Changing retention needs the settings:manage permission. Only an Owner can save.
- Changing workspace settings requires settings:manage in this workspace. The same refusal, from the API.
- … can be kept for … days. You chose a window that kind does not offer. The sentence lists the days it allows.
- Could not load retention. / Could not save retention. Reload and try again.
With the API
Not available with an API key.