execute retention-setting
Use this command to set the Time-to-Live (TTL) for FortiNDR log tables. The setting applies in both standalone and sensor modes and persists across reboots and power cycles.
FortiNDR retention behavior is determined by the deployment model. Standalone and sensor deployments use execute retention-setting, while center deployments use execute center-retention-setting. Retention applies to log tables only. Physical files are deleted immediately after scanning. Disk capacity does not affect retention behavior.
Default retention values differ between standalone/sensor deployments and center deployments. Always verify defaults using the CLI command applicable to your deployment model.
Syntax
execute retention-setting <'service name'> <retention days>
| Variable | Description |
|---|---|
|
'service name' |
The specific retention category for FortiNDR data. Valid options (enclosed in single quotes):
Disk capacity does not trigger data deletion. Retention enforcement is based solely on configured TTL values for log tables and scanning workflows for physical files. |
|
retention days |
Number of days to retain data. Must be an integer between 1 and 264 (inclusive). Default values:
|
Example
execute retention-setting 'Network Events' 90
The command enforces the software’s supported limits and helps estimate data retention based on average AV and NDR throughput across VM and physical models.