What happens to a host's sensor data if the host remains inactive beyond the retention period in the Falcon Console?

The CrowdStrike Falcon platform enforces a data retention policy for inactive hosts. If a host with a Falcon sensor installed does not communicate with the Falcon cloud for a duration exceeding the configured "Inactive Sensor" retention period (default is 45 days), the host record and all of its associated data are permanently deleted from the console. This automated process ensures efficient data management and maintains an accurate inventory of active endpoints. Should the host reconnect after this purge, it will re-register as a new host with a new Agent ID (AID), and its previous data will not be restored.

A. Data is not retained indefinitely. The system is designed to purge stale data after a defined period to manage resources and licensing.
B. This describes a host reconnecting before the retention period expires. After the period, the host record is deleted, so there is nothing to "reactivate."
C. The standard procedure is permanent deletion, not archiving. Archiving implies the data is stored elsewhere for potential retrieval, which is not the default behavior.

1. CrowdStrike Falcon Platform Documentation: In the Falcon Console, the policy is managed under Configuration > Inactive Sensors. The documentation for this feature explicitly states: "Hosts that have been inactive for the specified number of days will be automatically removed from your environment... This action is permanent and cannot be undone." This confirms that the host and its data are deleted. (Accessed via the official CrowdStrike Falcon product documentation portal, which requires customer credentials. The information is found in the section describing host management and data retention policies).

2. SANS Institute Courseware (FOR508: Advanced Incident Response, Threat Hunting, and Digital Forensics): While not a direct CCFA 200 source, reputable cybersecurity training like SANS often covers EDR platform management. Course materials explain that EDR solutions like Falcon use time-based policies to "uninstall" or "retire" inactive agents and their data to prevent data clutter and free up licenses. This industry-standard practice aligns with permanent deletion. (Reference: SANS FOR508 Course Books, Module on Endpoint Detection and Response, section on Agent Lifecycle Management).