Why is it important to know your company's event data retention limits in the Falcon platform?

The correct answer is B. You will not be able to search event data into the past beyond your retention period. It is important to know your company's event data retention limits in the Falcon platform because you will not be able to search event data into the past beyond your retention period. The retention period is the amount of time that event data is stored in the Falcon Cloud, and it

Investigate and Event Search

Question

Options

AThis is not necessary; you simply select "All Time" in your query to search all data
BYou will not be able to search event data into the past beyond your retention period
CData such as process records are kept for a shorter time than event data
DYour query will require you to specify the data pool associated with the date you wish to search

How the community answered

(45 responses)

A
2% (1)
B
93% (42)
C
4% (2)

Explanation

It is important to know your company's event data retention limits in the Falcon platform because you will not be able to search event data into the past beyond your retention period. The retention period is the amount of time that event data is stored in the Falcon Cloud, and it may vary depending on your subscription plan and settings. The other options are either incorrect or not related to knowing your retention limits.

Topics

#data retention#event search#query limitations#Falcon platform

Community Discussion

No community discussion yet for this question.

Full CCFA-200B Practice