Technical Note: ZoneFox 4.0 - How long is data retained in ZoneFox

[FortiKoala]

Description

How long is data retained in ZoneFox

Scope

FAQ

Solution

By default the data retention periods are: 

• 30 days for live user events – these are all events minus system events (see below)
• 12 months for compacted user events – after the “live” threshold user events are compacted to optimise the back-end storage. Compacted data is searchable and search results can be uncompacted back to Live to gain full access to corresponding event information.
• 7 days for system events – these are events involving resources in the following paths on Windows endpoints
  • Program Files
  • Program Files (x86)
  • Windows
  • AppData
  • Desktop.ini

 Note that any alerts, generated when an event matches a configured policy, are kept indefinitely.