How long does NetSenX keep the network evidence of an incident?

For the alert history of your plan: 30 days on Free and longer on each paid plan, with the exact periods on the pricing page. Alerts are stored with their time, the hosts involved, destinations, volumes and the reasons that drove them, together with analyst decisions in the audit log. If an incident may lead to a claim, questions from a regulator or a court case, do not rely on retention alone: export what matters while the incident is fresh, with PDF reports from the Starter plan, and keep the export with your other evidence. Think about the period you need before an incident happens: dwell times can be weeks, so a short history may end before the intrusion began. Your firewall, VPN and directory logs have their own retention, often shorter, which is worth checking today rather than during an incident.

← All 60 questions on Incident responseAll topics