Is 30 days of EDR data ever enough?

Only for genuinely low-risk environments. With a 14-day median dwell time, half of intrusions run two weeks or longer, and externally discovered breaches sat a median of 25 days, uncomfortably close to a 30-day cliff. If budget forces a short raw window, pair it with 12 months of alert and incident retention, which is far cheaper.

Does keeping telemetry longer create privacy problems?

It can. Endpoint telemetry captures user behavior, so privacy laws require you to justify how long you hold it and who can see it. Document the security purpose, restrict access to the archive, and purge on the schedule your policy states, indefinite "just in case" retention is a liability, not a safety net.

Should MSPs set the same retention for every client?

No. Tier it: a baseline window for low-risk clients, 12-month alert retention for everyone, and extended raw retention for regulated or high-risk clients who need it. Put the numbers in each service agreement, and revisit them at renewal. Retention is one of the easiest security levers to price transparently.

Does DMARC reporting need the same retention treatment?

DMARC aggregate reports are small enough that keeping a year or more costs little, and the history shows when spoofing campaigns against a domain began. But it is a different evidence layer: DMARC data cannot reconstruct endpoint activity, and EDR data cannot show who tried to forge your domain. Investigations go faster when you retain both.

How long should organizations retain EDR data for investigations?

Keep raw EDR telemetry searchable for at least 90 days, and keep alerts, incident records, and exported forensic artifacts for at least 12 months. Vendor defaults are much thinner than that: Microsoft Defender XDR lets you query only 30 days of raw data, and SentinelOne's Singularity Complete package includes 14 days. Meanwhile, Mandiant's M-Trends 2026 report puts the global median attacker dwell time at 14 days, and 25 days when someone outside the organization spots the breach. If your retention window is shorter than the time attackers spend inside networks, the evidence is gone before the investigation starts. Regulated environments need more still: PCI DSS requires 12 months of audit log history. Here is how to size retention without paying for storage you will never search.

What counts as EDR data?

EDR (endpoint detection and response) tools record what happens on every device they protect: process launches, file changes, network connections, registry edits, and logon events. Retention is simply how long that record stays stored and searchable.

Two jobs depend on it. Threat hunters query history to find attacks that slipped past real-time detection rules. Incident responders rebuild timelines to find patient zero and scope the damage. Once the retention window lapses, purged telemetry cannot be recovered, a digital forensic analyst can only work with what you kept. The same logic applies to server and application logs, but endpoint telemetry is the highest-volume, most expensive slice, which is why vendors cap it aggressively.

How long do major EDR vendors keep data by default?

Shorter than most people assume. Here are the published windows as of mid-2026:

Platform	Included searchable window	Extended options
Microsoft Defender XDR	30 days of raw data in advanced hunting; alerts and incidents kept 180 days	Stream tables to Microsoft Sentinel or a data lake tier for longer windows
SentinelOne	14 days in Singularity Complete; 90 days in the Commercial and Enterprise tiers	Longer retention is sold by package tier
CrowdStrike Falcon	Short included window that varies by subscription	Falcon Search Retention stores platform data "for months or years" via license upgrade; Falcon Long Term Repository advertises a year or longer

Two details catch teams out. First, "retention" runs on two clocks: Microsoft keeps alerts and incidents for 180 days while the raw hunting data behind them disappears after 30. Second, extended retention only collects going forward. Microsoft's docs state that streaming-API retention "starts from the first day that you implement and enable the streaming API", so turn it on before you need it, not during an incident.

Why are default retention windows too short?

Because attackers routinely outlast them. The M-Trends 2026 report measured global median dwell time at 14 days, up from 11 the year before. A median means half of all intrusions run at least that long. Organizations that found intrusions themselves did so in about 9 days, but breaches reported by an external party sat for a median of 25 days, and espionage and North Korean IT-worker cases ran a median of 122 days.

The joint CISA, NSA, FBI, and ACSC guidance on event logging and threat detection makes the same point: default retention periods are often insufficient, some incidents take up to 18 months to discover, and some malware dwells 70–200 days before causing overt harm. It recommends setting retention from a risk assessment, keeping logs "long enough to support cybersecurity incident investigations."

There is a second reason to retain data off-platform: attackers target the record itself. Techniques that blind or tamper with EDR agents can leave gaps in live telemetry, so an independent archive is often the only clean copy. Longer, intact history also directly improves how fast your team can scope and respond to incidents.

What do compliance frameworks require?

No regulation names "EDR" specifically, but several set floors for security records that EDR data falls under:

Framework	Retention expectation
PCI DSS 4.x, Requirement 10.5.1	Retain audit log history at least 12 months, with the most recent 3 months immediately available
HIPAA Security Rule	No explicit log number, but required documentation must be kept 6 years (45 CFR 164.316), and auditors commonly apply that bar to security activity records
US federal agencies	OMB M-21-31 required 12 months active plus 18 months cold storage; it was rescinded in May 2026 by M-26-14, which shifts agencies to risk-based, prioritized logging
CISA/ACSC joint guidance	Risk-informed; logs kept "long enough to support cybersecurity incident investigations"

Note the federal shift: M-26-14 dropped the blanket 30-month mandate because keeping everything proved expensive with little payoff, not because long retention stopped mattering. The replacement still expects agencies to justify windows against risk. That is a sensible model for MSPs too: for healthcare clients, start from what HIPAA actually requires; for anyone touching card data, PCI DSS applies (the same version that now expects DMARC-style anti-phishing controls).

What retention schedule should you actually set?

A tiered policy covers most organizations without runaway cost:

Raw telemetry, hot and searchable: 90 days. This covers the 14-day median dwell time with real margin, including the 25-day median for externally discovered breaches.
Alerts, detections, and incident timelines: 12 months minimum. These are tiny compared to raw telemetry and satisfy the PCI DSS 12-month expectation.
Closed-incident exports: keep with the case file. When an investigation ends, export the process trees, timelines, and artifacts into your case archive rather than relying on platform retention.
Regulated clients: match the strictest applicable framework, and put the number in the service agreement so nobody discovers a gap during an audit.
Review annually. Dwell times, prices, and regulations all moved in the last two years; your policy should too.

If a client uses a managed detection and response service, confirm whose retention applies. The MDR provider can only search as far back as the underlying platform license allows.

How can you extend retention without blowing the budget?

Full-fidelity telemetry across thousands of endpoints is expensive to keep hot, so spend where you actually query:

Buy vendor retention only for the data you search often. Upgrading alert retention is cheap; upgrading raw telemetry is not.
Stream to storage you control. Defender's streaming API, Sentinel data lake tiers, and CrowdStrike's license-based extensions all exist because 30 days is rarely enough. Cold object storage is fine for data you touch once a year.
Prune by value, not by age alone. Keep process trees and authentication events longer than bulk noise like routine system events.
Test restores quarterly. An archive you cannot restore, or that arrives without timestamps and hashes intact, is not evidence.

Where does email security data fit in?

Phishing remains one of the most common ways attackers get in, and when an intrusion arrives by email, endpoint telemetry only tells the second half of the story. EDR records what happened after compromise; email authentication data records what was attempted against your domains. DMARC aggregate reports (RUA) arrive daily, cost almost nothing to store, and show when spoofing attempts started. Useful context when you are trying to date an intrusion. Palisade's DMARC monitoring keeps that report history for MSPs so the lookback is there when an investigation needs it.

Be clear about limits, though: DMARC stops exact-domain spoofing, not lookalike-domain phishing, and it holds no endpoint evidence. Email records complement EDR retention; they do not replace it.

Common issues

The incident surfaced after the telemetry was purged. Check the longer-lived tiers first: Defender keeps alerts and incidents 180 days even though raw hunting data lasts 30, and your SIEM or firewall logs may cover the gap. Then fix the policy: extend the window and enable streaming now, because extended retention starts collecting only from the day you turn it on. If you are mid-breach, follow a structured plan for the first 24 hours.

Historical searches crawl or time out. Defender advanced hunting caps each query at a 30-day range, 10 minutes of runtime, and 100,000 result rows. Break long lookbacks into slices, filter by device or user early in the query, and run archive-tier searches in the archive tool rather than the live console.

A lapsed or switched license deleted the history. Microsoft deletes tenant data no later than 180 days after contract termination, and it is unrecoverable after that. Export open cases and key artifacts before any migration, and write offboarding exports into client contracts so departing customers keep their evidence.

The archive exists but will not hold up as evidence. Hash exports when they are created, restrict and log access to the archive, and preserve original timestamps and event IDs. A short chain-of-custody runbook written now saves an argument with lawyers later.