What happens to the data and alerts linked to a cloud account after it is deprovisioned from the Falcon console?

When a cloud account is deprovisioned from the CrowdStrike Falcon console, the platform ceases all new data collection and monitoring for that specific account. However, all historical data, including alerts, findings, and events that were ingested prior to deprovisioning, are retained. This historical information remains fully accessible within the Falcon console for investigation, reporting, and auditing purposes, ensuring that security teams do not lose valuable context from past activities.

A. Data is not deleted after a 7-day grace period; it is retained based on the standard data retention policy for the Falcon subscription.
B. Data is not immediately or permanently deleted. The deprovisioning action only stops future data ingestion, preserving the historical record.
C. Data is not specifically archived for 30 days before deletion. It remains accessible in the console alongside other historical data.

1. CrowdStrike Falcon® Documentation, Cloud Security, Managing Cloud Accounts: In the section detailing the process for deprovisioning cloud accounts (AWS, Azure, GCP), the documentation states: "When you deprovision a cloud account, Falcon stops monitoring the account, but all historical data and alerts remain available in the Falcon console." This confirms that deprovisioning halts new collection while preserving existing data. (This information is found within the Falcon Console's integrated help and official deployment guides for Cloud Security).