topic Re: Critical: data loss risk – daily log ingestion might be capped! in Endpoint

Critical: data loss risk – daily log ingestion might be capped!

MarcuzShinz — Tue, 02 Dec 2025 13:56:04 GMT

Hi Checkmates,

I’m currently facing an issue with our Harmony Endpoint Cloud tenant displaying the following message: “Critical: data loss risk – daily log ingestion might be capped! For more information please see SK182394.” I checked the SK and it seems that our daily logs are exceeding the allowed threshold, and we need to optimize this by disabling firewall accept logs.

Does anyone know how long log retention is supported for a Harmony Cloud tenant, and what the maximum storage capacity is?

Re: Critical: data loss risk – daily log ingestion might be capped!

Chris_Atkinson — Tue, 02 Dec 2025 14:11:06 GMT

Data Storage and Retention

Threat Hunting and Endpoint Data Retention is 90 days by default.
Ingestion limit is 110MB, per seat, per day.
Additional Data Retention is available for 1 year, by using the Threat Hunting Data Retention SKU/ Infinity Events SKUs.
For more information, see sk182394.

Source: https://sc1.checkpoint.com/documents/Infinity_Portal/WebAdminGuides/EN/Harmony-Endpoint-Admin-Guide/Topics-HEP/Logs-menu.htm

Re: Critical: data loss risk – daily log ingestion might be capped!

lluner — Tue, 02 Dec 2025 14:08:21 GMT

This link contains the information.

sk182394 - Cloud Log Analytics & Logging - Ingestion / Retention Solution

Re: Critical: data loss risk – daily log ingestion might be capped!

Chris_Atkinson — Wed, 03 Dec 2025 01:10:29 GMT

Worth checking that the desktop firewall policy isn't set to log 'everything' a common trap.

Re: Critical: data loss risk – daily log ingestion might be capped!

MarcuzShinz — Wed, 03 Dec 2025 02:06:01 GMT

I have one more question, so can we manual delete the logs on the cloud tenant harmony? because for now I still see the warning on tenant, but we have disable log record on some policy firewall.

Re: Critical: data loss risk – daily log ingestion might be capped!

Chris_Atkinson — Wed, 03 Dec 2025 02:43:23 GMT

Retention and Ingestion are separate issues, you may need to monitor for a period to see if the trend is reducing to the required level.