About data retention time
March 20, 2024
ID 228505
The data that is used for the Kaspersky Endpoint Detection and Response Expert operation includes the following:
- Telemetry events sent from devices in your organization
- Custom IOA rules and exclusions from Kaspersky IOA rules
Retention time of telemetry events
Telemetry data is stored and processed in the Kaspersky Endpoint Detection and Response Expert infrastructure for 30 days. An event is automatically deleted 30 days after it was sent. After the license expiration date, telemetry events will also be deleted within 30 days. After 29 days, you can get data that was sent on the last day when the license was valid.
You can extend the storage and processing time of telemetry data to 60 or 90 days by adding an Extension module.
Retention time of Custom IOA rules and exclusions from Kaspersky IOA rules after the license expiration date
After your license has expired, the settings are stored for 30 days. After 30 days, they will be automatically deleted.
