Log retention time is the duration for which logs are stored and accessible for analysis and / or audit purposes. Netskope’s log retention time varies on factors, such as:
- log type
- business needs
- industry regulations
- security best practices (e.g. availability of storage, the frequency of analysis, disposal methods, etc.)
Retaining the logs can help customers identify security incidents, monitor policy violations, identify fraudulent activity, and ensure compliance with laws, rules, and regulations. Different industry and security compliance requirements may dictate different log retention times for these logs.
The following is a table of data retention periods across different types of Netskope events and logs. Any extension of the retention period beyond the default listed is subject to the entitlement of the associated product.
| Data Collection | Skope IT3 | Reports | Extended Data Retention (Skope IT and Reports) | Netskope Advanced Analytics2 |
|---|---|---|---|---|
| Application Events | 90 | 90 | 3651 | 7 days to 13 months |
| Page Events | 90 | 90 | 3651 | 7 days to 13 months |
| Network Events for Private Access | 30 | 30 | 30 | 7 days to 13 months |
| Network Events for Cloud Firewall | 30 | 30 | 30 | 7 days to 13 months |
| Alerts | 90 | 90 | 3651 | 7 days to 13 months |
| Endpoint Events | 90 | N/A | 3651 | 7 days to 13 months |
| Audit Logs3 | 90 | N/A | 3651 | N/A |
| DLP Incidents3 | 90 | N/A | 3651 | 7 days to 13 months |
| Transaction Events | 30 | N/A | N/A | 7 days to 13 months |
| Device (Client Event Data) | N/A | N/A | N/A | 7 days to 13 months |
| SSPM4 | N/A | N/A | N/A | Latest Scan Results |
| DSPM | N/A | N/A | N/A | N/A |
| 1 :: Netskope Standard Reporting Extended Data Retention extends data retention in accounts from 90 days to 1 year to allow you to run queries on a larger data set. Netskope does not offer CFW, NPA, and Transaction Event Logs extended storage in Skope IT / Reports. Best practice is to purchase transaction events streaming service to stream the logs to the storage of your choice. | ||||
| 2 :: Netskope Advanced Analytics storage is based on data usage and supports data collections listed in the Netskope Advanced Analytics column. | ||||
| 3 :: DLP Incidents is visible in the 'Incidents' section of the Admin UI. Audit logs can be found in the Admin settings page. Extended data retention for these two data collections are also available. | ||||
| 4 :: 'SSPM Evaluation Results' shows the latest scan results based on query run date or dashboard load. | ||||
There are additional product specific data retention topics available.
To learn more: