Data Retention

XTD SIEM API Integration Guide

The API provides a 24 hour rolling window view of the data available to the customer. This means that at any given point, a request to the API has at most 24 hours of data available to it. A subsequent request will mean that the rolling window has moved, and the data at the back of that window will no longer be available.

Any access to the data must take the rolling window into consideration. If a continuous set of data is required, the caller must ensure that data is polled at regular intervals.