Version

Argent Omega all versions

Date

Wednesday, 10 January 2024

Summary

By default, Argent Omega retains ALL data without any limitations. Customizing your retention settings is always recommended and highly important to maintain a predictably sized repository in the long term

Technical Background

Configure the three primary data retention settings seen below: 1. Argent SIEM-Complete, 2. Argent Compliance Automator, and 3. all other data retention leveraged in Argent Reporter (ALL data saved to the repository that excludes SIEM-Complete or Argent Compliance Automator)

Note: If you are not licensed for a particular module, you can skip configuring that retention setting as you are not retaining data in that area

Resolution

1. Argent SIEM-Complete Data Retention

   From the Home screen, use the search bar and enter ‘Argent SIEM-Complete’ and select ‘Argent SIEM-Complete’ from the search results

   
   
   Click For Full Size

   Uncheck the box for ‘Do Not Purge Data’, then set the ‘Data Retaining Days’ to your organization’s required number of days, and lastly select ‘Save’ on the bottom

   
   
   Click For Full Size

   Note: If your organization leverages multiple separate Archive Repositories, each specific Archive Repository has its own retention setting and must be configured by expanding then selecting each under the ‘Archive Repository’ folder

2. Argent Compliance Automator Data Retention

   From the home page, search for ‘Argent Forecaster’ and select the Argent Forecaster from the search results

   
   
   Click For Full Size

   Uncheck the box for ‘Do Not Purge Data’, then set the ‘Data Retaining Days’ to your organization’s required number of days, and lastly select ‘Save’ on the bottom

   
   
   Click For Full Size

   Note: If your organization leverages multiple separate Archive Repositories, each specific Archive Repository has its own retention setting and must be configured by expanding then selecting each under the ‘Archive Repository’ folder

3. All other data retention leveraged in Argent Reporter: ALL data saved to the repository that excludes SIEM-Complete or Argent Compliance Automator

   To clarify this definition, if your configured Rule has the option ‘Save Performance Data To The Argent Forecaster Using Data Store’ enabled AND the Rule does not pertain to Argent SIEM-Complete OR Argent Compliance Automator, then this step determines the data retention

   From the home page, search for ‘Argent Forecaster’ and select the Argent Forecaster from the search results

   
   
   Click For Full Size

   In the left-hand side navigator, expand Argent Forecaster, then expand Data Stores, and select your data store
   Under the ‘Argent Forecaster Data Aggregation’, you can change the ‘Retaining Policy’ value by double clicking earch row, unchecking ‘Do Not Purge Shardings’, then set your preferred ‘Retaining Days’.

   
   
   Click For Full Size

   Note: If your organization leverages multiple separate Data Stores, each specific Data Store has its own retention setting and must be configured by expanding then selecting each under the ‘Data Stores’ folder

For further assistance, please contact Argent on Instant Help at
https://Instanthelp.Argent.com/