Data Retention

Contextal Platform stores processing results and actions indefinitely to permit contextual matching, threat hunting, efficacy reviews, etc.

On the other hand, the object data, which is technically required only during the processing, is regularly evicted in order to prevent clutter and keep disk usage under control.

This is a tradeoff: making data available for a prolonged time helps with detailed review and additional scrutiny but can be problematic in high-load environments or when specific data policies are required.

The default lifetime of object data is set to one day and can be customized to optimize storage usage or meet compliance requirements.

Specific instructions are provided under the Kubernetes and the Quick Start setups.