SentinelOne Corp. 90 Day Retention Per Endpoint Data Retention Extension for EDR Hunting and Investigation

Enterprises take an average of 280 days to identify and contain a breach. While there could be many reasons for a lengthy mean time to detect (MTTD), one of the key factors is the lack of availability of historical EDR data. As Gartner pointed out in one of its blogs, "if you typically detect compromised assets in 60 days after the attacker gets in...and you store... for 30 days, why the hell are you doing it? " A question worth considering! The recent SUNBURST attack is yet another instance that has highlighted how critical it is to have a longer "look back" capability, typically needed to investigate and validate IOCs in the environment.