The settings in the Retention Scheduler tab allow you to specify a retention period for alerts and incidents.
To access the Retention Scheduler tab:
In the Security Analytics menu, select Incidents > Configure.
The Configure panel opens to the Aggregation Rules tab by default.
Select the Retention Scheduler tab.
The Retention Scheduler tab has these features:
|Number of days||Specifies how long to keep alerts and incidents before they get deleted.|
|Enable||Deletes alerts and incidents when the retention period ends.|
|Apply||Puts the settings into effect immediately.|