Cortex XDR's data retention model is based on the Cortex Data Lake. By default, each Cortex XDR license type (e.g., Pro per Endpoint, Pro per TB) includes a standard retention period, typically 30 days. For organizations requiring longer-term data storage for compliance or extended threat hunting, Palo Alto Networks offers specific data retention add-on licenses. These add-ons allow customers to purchase extended storage capacity and increase the retention period significantly, often up to a year or more, ensuring data is available for historical analysis directly within the platform.
