execute center-retention-setting
Use this CLI to set retention, Time to Live (TTL) for FortiNDR log tables. This is software theoretical limit for retention, for estimation of retention in different VM/physical models based on average AV and NDR throughput. This execute action is persistent after reboot/power-cycle.
For more information, see Planning deployment.
FortiNDR retention behavior is determined by the deployment model. Standalone and sensor deployments use execute retention-setting, while center deployments use execute center-retention-setting. Retention applies to log tables only. Physical files are deleted immediately after scanning. Disk capacity does not affect retention behavior.
Default retention values differ between standalone/sensor deployments and center deployments. Always verify defaults using the CLI command applicable to your deployment model.
Syntax
execute center-retention-setting <'service name'> < retention days >
|
Variable |
Description |
|---|---|
|
'service name' |
Select the retention setting for FortiNDR data. Available service names are:
Ensure the service name is enclosed in single quotes (‘). Disk capacity does not trigger data deletion. Retention enforcement is based solely on configured TTL values for log tables and scanning workflows for physical files. |
|
retention days |
Data retention in days. Valid range is from 1 – 730 days. Default values:
FNDR‑1000F supports standalone/sensor mode only. As a result, default retention settings for FNDR‑1000F are configured and viewed using the execute retention-setting command
|