Fortinet white logo
Fortinet white logo

CLI reference

execute center-retention-setting

execute center-retention-setting

Use this CLI to set retention, Time to Live (TTL) for FortiNDR log tables. This is software theoretical limit for retention, for estimation of retention in different VM/physical models based on average AV and NDR throughput. This execute action is persistent after reboot/power-cycle.

For more information, see Planning deployment.

FortiNDR retention behavior is determined by the deployment model. Standalone and sensor deployments use execute retention-setting, while center deployments use execute center-retention-setting. Retention applies to log tables only. Physical files are deleted immediately after scanning. Disk capacity does not affect retention behavior.

Default retention values differ between standalone/sensor deployments and center deployments. Always verify defaults using the CLI command applicable to your deployment model.

Syntax

execute center-retention-setting <'service name'> < retention days >

Variable

Description

'service name'

Select the retention setting for FortiNDR data. Available service names are:

  • Network Events
  • File Events

    File retention differs for log entries and physical files:

    • File log entries are retained according to the configured TTL for the File Events service, which varies by deployment model.
    • Physical files classified as clean are deleted immediately after scanning is completed, regardless of retention settings.
  • Sensor Monitor Data
  • Machine Learning Data

Ensure the service name is enclosed in single quotes (‘).

Disk capacity does not trigger data deletion.

Retention enforcement is based solely on configured TTL values for log tables and scanning workflows for physical files.

retention days

Data retention in days. Valid range is from 1 – 730 days.

Default values:

  • Network Events and File Events: 264 days

    The following datasets are retained for 365 days by default:

    • Session data used by Investigation and Global Query
    • NetFlow data
  • Sensor Monitor Data and Machine Learning Data: 7 days
FNDR‑1000F supports standalone/sensor mode only. As a result, default retention settings for FNDR‑1000F are configured and viewed using the execute retention-setting command

execute center-retention-setting

execute center-retention-setting

Use this CLI to set retention, Time to Live (TTL) for FortiNDR log tables. This is software theoretical limit for retention, for estimation of retention in different VM/physical models based on average AV and NDR throughput. This execute action is persistent after reboot/power-cycle.

For more information, see Planning deployment.

FortiNDR retention behavior is determined by the deployment model. Standalone and sensor deployments use execute retention-setting, while center deployments use execute center-retention-setting. Retention applies to log tables only. Physical files are deleted immediately after scanning. Disk capacity does not affect retention behavior.

Default retention values differ between standalone/sensor deployments and center deployments. Always verify defaults using the CLI command applicable to your deployment model.

Syntax

execute center-retention-setting <'service name'> < retention days >

Variable

Description

'service name'

Select the retention setting for FortiNDR data. Available service names are:

  • Network Events
  • File Events

    File retention differs for log entries and physical files:

    • File log entries are retained according to the configured TTL for the File Events service, which varies by deployment model.
    • Physical files classified as clean are deleted immediately after scanning is completed, regardless of retention settings.
  • Sensor Monitor Data
  • Machine Learning Data

Ensure the service name is enclosed in single quotes (‘).

Disk capacity does not trigger data deletion.

Retention enforcement is based solely on configured TTL values for log tables and scanning workflows for physical files.

retention days

Data retention in days. Valid range is from 1 – 730 days.

Default values:

  • Network Events and File Events: 264 days

    The following datasets are retained for 365 days by default:

    • Session data used by Investigation and Global Query
    • NetFlow data
  • Sensor Monitor Data and Machine Learning Data: 7 days
FNDR‑1000F supports standalone/sensor mode only. As a result, default retention settings for FNDR‑1000F are configured and viewed using the execute retention-setting command