Data retention
IBM Security QRadar® Suite Software stores both active and historical asset and risk data, but storing too much historical data can negatively impact performance.
The data retention policy sets the threshold for how long historical data is retained. Active data is never purged regardless of the data retention policy settings.
On initial installation, the system allocates enough disk space to store asset and risk data for approximately 50 K assets, which is approximately 1.2 GB of storage. The allocated disk space is used to store the active data that was collected during the last scan, and any remaining disk space is used to store historical data from past scans.
The amount of historical data that you can store depends on the number of assets that you have. For example, a company that has 20 K assets has less active data than a company that has 40 K assets. In this scenario, the smaller company can store more historical data in the allotted space.
If your company has many assets and the active data exceeds the amount of disk space that is allotted on initial installation, the system keeps all of the active data. It does not retain any historical data.