Retention

Retention is enforced in the SIEM by index state management policies that delete data after the window. A change re-provisions the policy for that source. Dead letter and audit retention are set by configuration.