Retention Policies

Overview

The Retention Policies page lets administrators configure how long generated operational data remains available in OpenSearch before cleanup jobs remove older records. These settings control storage usage for notifications, action logs, attack statistics, day-traffic indices, Logstash indices, and Prometheus metrics indices.

Use this page to:

• Review the active retention periods, in days.
• Extend retention when you need more historical data for investigation or reporting.
• Shorten retention when storage usage must be reduced.

All retention policy settings are predefined by the system. You can edit their values but cannot add or remove policies from this page.

How to Open This Page

1. Click Administration in the main navigation bar.
2. Click the Retention Policies tab (the last tab in the tab strip).

The settings list loads automatically.

Permission required: Your account must belong to a group that has the Modify Settings permission to change values, or the View Settings permission to view them read-only. If the Retention Policies tab does not appear, ask an administrator to grant one of these permissions to your group.

Main Areas

Click to enlarge

• 1 Administration tab strip – the Retention Policies tab is highlighted while you are on this page.
• 2 Search field – Search by name or description… filters the list as you type.
• 3 Expand all / Collapse all – open or close every settings group at once.
• 4 Group header – the collapsible Retention policies group with its setting count.
• 5 Settings table – one row per retention policy, with the columns Name, Value and Actions.
• 6 Help tip (question-mark icon) – hover or focus it for a short explanation of the row.
• 7 Edit button (pencil icon) – opens the edit dialog for that policy.

Search and Groups

• Type in Search by name or description… to show only the policies whose name or description contains the text. Press Escape or click the X in the field to clear the search. While you search, the Expand all / Collapse all buttons are hidden and matching rows are shown even if their group is collapsed. If nothing matches, the page shows No settings match followed by your search text.
• Click the group header (Retention policies, with the number of settings next to it) to collapse or expand the group. The arrangement is remembered in your browser, so the group stays collapsed or expanded when you come back to this tab.

Table Columns

Row Help Tips

Each row starts with a question-mark icon. Hover over it (or focus it with the keyboard) to display a short explanation, for example: Retention policy “NotificationsRetentionPolicy” – sets how long collected data is kept. Click the pencil to edit its value.

Click to enlarge

Settings Reference

Each value is a whole number of days. After the configured period expires, the corresponding cleanup process deletes records older than that value. All policies accept values from 1 to 3650 days and default to 30 days.

Editing a Retention Policy

1. Find the policy you want to change (use the search field if needed).
2. Click the Edit button (pencil icon) in the Actions column. A dialog titled Edit Setting: followed by the internal setting name opens.
3. Enter the new number of days in the Value field. The setting description is shown above the field, and the hint below it shows the Accepted range and the Default value.
4. Click Save to apply the change, or click Close (or the X in the dialog header) to discard it.

Click to enlarge

• 1 Dialog title with the internal setting name.
• 2 Setting description, for example Notifications retention (days).
• 3 Value field with the current number of days.
• 4 Range hint – Accepted range: 1 to 3650 days · Default: 30.
• 5 Close and Save buttons.

The Save button is disabled while the field is empty. After a successful save, a confirmation message appears, the dialog closes, and the list is refreshed with the new value.

Confirmation When Reducing Retention

If the new value is lower than the current one, a confirmation dialog appears before anything is saved, because shortening the period causes existing data to be deleted:

Click to enlarge

• Reduce this retention period? – Data older than the new value will be permanently deleted the next time cleanup runs. This cannot be undone.
• Click Cancel to go back to the edit dialog without saving, or Yes, continue to save the shorter period.

Increasing a value saves directly, without this confirmation.

Validation Rules

• Values must be whole numbers between 1 and 3650 days.
• Values outside this range are rejected in the dialog before they are sent (the browser points out the allowed limit), and the server enforces the same range again when saving. If the server rejects a value, the error message is shown in red under the Value field, the dialog stays open, and nothing is changed – for example, Notifications retention must be at most 3650 days (got 5000).
• Empty values cannot be saved.

Click to enlarge

Notes

• Changes affect cleanup behavior. Increasing a value keeps future cleanup jobs from removing records until they are older than the new threshold. Decreasing a value allows older records to be removed at the next cleanup run.
• Deleted data is not restored. If records were already removed by a previous cleanup run, increasing retention later does not bring them back.
• Retention values are global. A change affects the whole platform, not only the current user.
• Settings are predefined. You cannot add new retention policies or delete existing ones from this page.
• Read-only access. Users with only the View Settings permission can open this page, search and expand/collapse the list, but cannot edit values.

Related Pages

• Administration – Return to the main administration hub.
• Action Manager – Configure the automated response service that writes action logs and attack statistics.
• Actions – View retained action history.
• Notifications – View retained attack notifications.
• Stats – Review dashboard data that may depend on retained metrics and traffic indices.