Carbon Black Cloud: How Long Are Alerts and Events Kept?

[#1]

Environment

• Carbon Black Cloud Console: All Versions

Question

How long are Events and Alerts able to be seen and reviewed in the Console?

Answer

• Alerts and the Events linked to them are stored for 180 days.
• Events not associated with any Alerts are stored for 30 days.
• Watchlist hits are stored for 30 days like Events not associated with Alerts.

Additional Notes

• Increased retention is available as an add-on product through VMware Data Retention for VMware Carbon Black Cloud.
• These retention settings were implemented in the August '16 release (0.18.x) of the Carbon Black Cloud Console.

Related Content

Carbon Black Cloud: Are Events able to be retrieved from the Backend when event data retention cut-o...
Cb Defense: Severity, Threat Level, Target Value, Malware Types Information
Cb Defense: How is event data categorized, identified, and formed into an Alert?
Endpoint Standard: Event ID vs Alert ID vs Threat ID