XDR Data Retention

Making Sure Your XDR Platform Outlasts Your Adversaries + The very essence of an XDR platform is facilitating detection and response to persistent threats by collecting and analyzing data from different sources, with endpoints being the most dominant points of origin.

Collecting all the correct data, however, is only one part of the equation. Just as important is: how long will your data be available? Put another way, how important is it to be able to go back in time? And, indeed, how far back can you go?

While having a rich data supply is obviously a necessary condition for any effective XDR platform, the platform is only as good as the longevity of its data. Threat actors are patient adversaries, and your XDR platform needs to be able to out-wait your attackers. So, when it comes to data retention, just how long is long enough?

The Need for Data Retention

Here’s a typical statement from a Security Researcher about an incident he handled:

This is just one case, but it does hint that security teams often discover how much data retention they need only when they come face-to-face with threats that linger in their environments for long periods. For many of them, it’s a case of hindsight being 20/20.

Also, even large and resourceful corporations often choose not to invest in making sure they have the data they need for as long as they will need it.

The anonymous story above may remind readers of a recent chain of events  around one of the most concerning campaigns of recent years: SUNBURST.  After the attack was found, the related DNS calls published by CloudFlare showed that infections began as  early as April 2020 and took eight months to discover.

More here.