Applies To: Endpoint Security Elite, Endpoint Security 360, Endpoint Security Prime, WatchGuard EDR, WatchGuard EDR Core, Endpoint Security Basic
In WatchGuard Cloud, the data retention period is the number of days that data is stored by WatchGuard. By default, the data retention period for Endpoint Security products is:
- Endpoint Security Elite (formerly WatchGuard Advanced EPDR) — 90 days
- Endpoint Security 360 (formerly WatchGuard EPDR) — 90 days
- Endpoint Security Prime — 30 days
- Endpoint Security Basic (evolved WatchGuard EPP) — 30 days in the management UI only
- WatchGuard EDR — 90 days
- WatchGuard EDR Core — 90 days
These periods define how long data is retained in the cloud storage and how long data is available in the management UI. The data available in these areas of the Endpoint Security management UI reflects the data retention policy:
- Security dashboard
- Web Access dashboard
- Indicators of Compromise (IoC) dashboard
- Endpoint Access Enforcement dashboard
- Lists associated with the dashboards
- Computer details
Data older than the period covered by the data retention policy does not appear in the user interface.
To extend the data retention period for an account, use the Endpoint Security 1-Year Data Retention module. This module extends the data retention period for WatchGuard Endpoint Security Prime, 360, and Elite to one year. One-year, three-year, and monthly licenses are available.
Data Deletion Schedule
Once a day, an automated process removes stored data that is older than the current data retention period for an account. The process starts at 1:00 AM UTC and takes some time, so the exact time when the process deletes older data can vary.
Deallocation and License Expiration Grace
If you deallocate endpoints or remove the Endpoint Security 1-Year Data Retention module, after a seven-day grace period, WatchGuard removes stored data associated with the endpoints from WatchGuard Cloud.
About Endpoint Security Licenses