What happens to the data and alerts linked to a cloud account after it is deprovisioned from the Falcon console?

Option A: Data visibility is not tied to re-registration within a specific timeframe. Historical data is

retained regardless of whether the account is re-registered or permanently deprovisioned. This answer

introduces an unnecessary restriction.

Option B: CrowdStrike retains historical data for compliance and forensic purposes. Immediate and

permanent deletion would hinder post-deprovisioning investigations or audits, which is not the intended

behavior of the Falcon platform.

Option C: There is no automatic data archival or deletion process tied to deprovisioning a cloud account

in Falcon. Historical data remains accessible for an extended period, as determined by organizational data

retention policies.

Option D: When a cloud account is deprovisioned from Falcon, the platform stops collecting new data

and generating alerts for the account. However, historical data and alerts are retained for compliance and

auditing purposes. This ensures organizations can review past activity and investigate incidents even after

the account is deprovisioned.