How long are detection events kept in Falcon?

The retention period for detection events within the CrowdStrike Falcon platform is not a fixed duration for all users. It is directly tied to the customer's subscription level and any purchased data retention add-ons. While a 90-day period is a common default for detections in many subscription tiers, the definitive answer is that the retention period is determined by the specific terms of the customer's agreement. This allows organizations to select a data retention policy that meets their unique operational, regulatory, and compliance requirements, with options for extended storage available.

A. Detection events are kept for 90 days: This is a common default retention period for detections, but it is not universally true for all subscription levels and can be extended.

C. Detection events are kept for 7 days: This is the typical default retention period for raw Endpoint Detection and Response (EDR) event data, not for curated detection events.

D. Detection events are kept for 30 days: While a possible configuration, this is not the standard default for detections and is less common than the 90-day default period.

1. CrowdStrike

Inc. "Falcon Platform: Data Retention" (Support Portal Documentation). The official CrowdStrike support documentation explicitly states that data retention periods for different types of data

including detections and events

are based on the customer's subscription. It details the default periods (e.g.

90 days for detections) and clarifies that these can be extended. (Note: Access to this document requires a CrowdStrike customer portal login. The information is standard knowledge provided during official CCFA training.)

2. CrowdStrike

Inc. "CrowdStrike Falcon Insight XDR" (Product Data Sheet). Product data sheets for Falcon modules like Insight XDR describe data retention as a key feature. They specify that while a base retention period is included

customers can purchase extended retention to meet long-term threat hunting and compliance needs

confirming the subscription-based model. (Document available via the official CrowdStrike website's resource library.)