Configure Retention Policy for Memory Dumps and MFT

An administrator can configure the retention policy to delete the downloaded system dump, process dump, and Master File Table (MFT) from the Endpoint server based on the number of days. By default, this option is enabled.

To configure the retention policy:

  1. Go to netwitness_adminicon_25x22.png (Admin) > Services.

  2. In the Services view, select Endpoint Server.

  3. Click netwitness_actions_icon.png and select > View > Config.

  4. Click the Data Retention Scheduler tab.

    netwitness_datretsch.jpg

  5. In the Memory Dumps and MFT Retention Policy panel, by default, the Threshold is set to 90 days and Run to every day. This means only 90 days of data is retained and the older data is deleted from the Endpoint server.
  6. Click Apply.