Configure SIEM data retention

Supported in:

Google secops SIEM

By default, Google retains 12 months of your data in your Google Security Operations account. You can extend the retention period for up to five years as part of your Purchase Order. The retention period applies to all of the data in your Google SecOps instance. For example, you can't modify the data retention policy for a specific log type.

Important: You cannot delete log data manually in Google SecOps.

Google uses an automated system to remove historical data based on the following:

• Raw logs: Retention is determined by the ingestion timestamp (when the log arrived in the system).
• UDM events: Retention is determined by the UDM event time (the timestamp within the normalized data structure).

Note: It may be possible to see extended events at the margins of the retention period. For example, if a detection includes component events marginally older than the retention period.

View your data retention start date in Google SecOps

The Data Retention page is a read-only section within the SIEM settings that shows the date when data retention began for your account.

To view your data retention start date, follow these steps:

• In the navigation bar, select SIEM Settings > Data Retention. The Data Retention page displays the retention start date in yyyy-mm-dd format.

To learn about where data in the Google SecOps account is stored, see SecOps service locations.

For more information, see Google SecOps pricing.

Need more help? Get answers from Community members and Google SecOps professionals.