About data retention time
The data that is used for the Kaspersky Endpoint Detection and Response Expert operation includes the following:
- Telemetry events sent from devices in your organization
- Custom IOA rules and exclusions from Kaspersky IOA rules
Retention time of telemetry events
Telemetry data is stored and processed in the Kaspersky Endpoint Detection and Response Expert infrastructure for 30 days. An event is automatically deleted 30 days after it was sent. After the license expiration date, telemetry events will also be deleted within 30 days. After 29 days, you can get data that was sent on the last day when the license was valid.
You can extend the storage and processing time of telemetry data to 60 or 90 days by adding an Extension module.
By default, the telemetry data is stored in Kaspersky Endpoint Detection and Response Expert infrastructure for 30 days. You can buy an Extension Module to extend the storage time. An Extension Module is a license and can be of two types:
- Kaspersky Endpoint Detection and Response Expert Telemetry Retention 60 days
- Kaspersky Endpoint Detection and Response Expert Telemetry Retention 90 days
If you add both Extension Modules, the Extension Module with a longer retention period is applied in Kaspersky EDR Expert. Retention periods do not sum up.
When you add an Extension Module, the retention time of telemetry data depends on whether the telemetry was sent before adding the Extension Module or after it:
- Before adding an Extension Module. The storage time is defined by the license that was active when the data from assets was sent.
- After adding an Extension Module. The storage time is defined by the time that is specified in the Extension Module.
If you cancel the Extension Module in the future, the retention time will be returned to default. The telemetry that was sent when the Extension Module was in effect, is stored for the time that is specified in the Extension Module.
Retention time of Custom IOA rules and exclusions from Kaspersky IOA rules after the license expiration date
After your license has expired, the settings are stored for 30 days. After 30 days, they will be automatically deleted.
Page top