Feature request: Add a data retention time field for products when mapping data sources.

[nulltrino]

It would be beneficial to map the products with their respective data retention times. As a defender, knowing how long the data is stored is crucial when conducting investigations.

[rubinatorz]

Hi @nulltrino,

You can do this by using the "custom key value pairs" option. For example like this:

You can determine these fields and the convention of names and values yourself.

[nulltrino]

Hi @rubinatorz

Thank you for your response!

Creating custom fields gets the job done but having a built-in retention period field next to the product would take away that manual labor. Considering that there are times when an organization may have multiple products for each data source (e.g. collecting WEF and also running an EDR solution), and each solution has a different data retention period, this will translate to creating a lot of custom columns.

[nulltrino]

I am just brainstorming here, but what if an additional section is added to the editor that can be populated with product information (e.g. product name, retention period, data/product type), and then the data source section can refer to it (just like the drop-down menu that is used to populate the applicable_to field).
I know this is easier said than done, but I hope this can be food for thought.

[rubinatorz]

Hi @nulltrino,

I get your idea now, and I think that's indeed something that can have value for some organisations. We will put it on our backlog. We have lots of other things on there that have higher priority, so we can not promise anything.