Which data types can be retained?

Field Effect can retain several types of data, including:

Field Effect and Field Effect-related logs

(for the purposes of this document and for pricing, these are referred to as “Field Effect logs": 

• Alerts that Field Effect generates, from endpoint agents, network monitoring, cloud monitoring and content analysis. 
• Logs that Field Effect uses to generate alerts as part of a standard deployment. This includes Windows event logs, as well as the relevant logs generated by the cloud applications included as part of the cloud monitoring service.

Non-Field Effect logs

(these are syslogs that are generated by other systems but are not part of the Field Effect service, nor are they logs that Field Effect uses to generate alerts. These would be applicable if there were additional logs retention requirements in order to comply with specific regulations. 

• Examples include logs from external systems: system logs forwarded to the appliance from firewalls, switches, VPN appliances, other network equipment, and Security Service Edge (SSE) solutions. 
• These logs must be in syslog formatted, and forwarded to the appliance