Retention, evidence, and holds
Separate event history from raw artifacts, preserve integrity, and manage export and deletion.
Guard retains event history, investigation records, and raw evidence under separate controls. A detection can remain visible after its raw artifact has expired; an evidence reference is not a promise that bytes remain available.
Retention classes
Open Organization → Data → Retention to inspect the effective policy for each data class:
| Data | Retention rule |
|---|---|
| Alerts and logs | 13 calendar months from ingestion by default; calculate expiry by calendar month, not a fixed 390 days |
| Incident and finding records | The organization's displayed record-retention policy |
| Raw evidence | The explicit evidence lifetime selected during setup or collection |
| Local quarantine | The endpoint's adopted quarantine-retention policy |
| Backups | Their independent backup-retention schedule |
Before reducing retention, inspect the deletion preview for existing data that will become eligible. Confirm the change only after reviewing those items and the scheduled cleanup time. Deleting a live record does not immediately remove retained backup copies.
For missing artifacts or storage-pressure alerts, inspect Installation → Health → Storage and follow evidence troubleshooting. A retention deadline alone does not establish that the object is still readable.
Collect and verify evidence
At Incident → Evidence → Collect, select the source and artifact, purpose, permitted reviewers, and retention. The executor must have the relevant capability and the requester must have evidence collection permission. Collection can fail independently of the detection.
Each item records evidence_id, source asset and executor IDs, collection and ingestion times, byte length, SHA-256 digest, access history, and any transformations. Redacted or normalized exports receive a separate digest; they are not byte-identical originals. A digest detects changed content but does not establish that the original source was truthful or its clock correct.
Use Evidence → Verify integrity before relying on an artifact. A missing object or digest mismatch marks it unavailable or invalid; preserve the failure record and investigate storage or collection integrity. Do not replace the original artifact under the same evidence ID.
Export and holds
Use Incident → Evidence → Export for a bounded package with manifest, selected artifacts, digests, and collection metadata. Downloads require the evidence grant and are audited; links are short-lived and must not be included in broadly shared reports. Keep downloaded copies under the recipient's own access and deletion controls.
A hold manager selects Evidence → Holds → Create hold, provides a reason, owner, and review date, and chooses evidence or incident scope. Holds block ordinary deletion and relevant cleanup. Releasing a hold requires separate authorization and an audit reason; it does not immediately purge data that remains within normal retention.
For deletion, open Organization → Data → Deletion requests and review the selected items' references and holds. Submit eligible items, then open the returned operation. Confirm it succeeded and the items' availability is updated; acceptance alone is not deletion. A hold conflict must be resolved by an authorized hold manager before retrying.
Retiring an asset or closing an incident leaves its evidence under these retention rules. Use the Evidence API for automated collection, holds, exports, and deletion.