Search Data Retention Policy

By default, Anomali Search retains event data in searchable "hot" buckets for 90 days. After this period, data automatically moves to archive buckets, where it is preserved according to the retention terms defined in your license agreement.

Contact Anomali Support for more assistance with retrieving the archived data.

Searching Archived Data

Queries against archive buckets may result in significantly higher Anomali Virtual Compute (AVC) usage. To safeguard against unintentional resource drain and AVC usage, searches are restricted to hot buckets by default.

If your use case requires access to archived data, Anomali recommends submitting a support ticket. Once approved, your user account will be configured to search beyond the default window.

See Anomali Virtual Compute to understand its usage and the different user actions that lead to AVC usage.