Critical: data loss risk – daily log ingestion might be capped!

[MarcuzShinz]

Hi Checkmates,

I’m currently facing an issue with our Harmony Endpoint Cloud tenant displaying the following message: “Critical: data loss risk – daily log ingestion might be capped! For more information please see SK182394.” I checked the SK and it seems that our daily logs are exceeding the allowed threshold, and we need to optimize this by disabling firewall accept logs.

Does anyone know how long log retention is supported for a Harmony Cloud tenant, and what the maximum storage capacity is?

[Chris_Atkinson · Accepted solution]

Data Storage and Retention

• Threat Hunting and Endpoint Data Retention is 90 days by default.

• Ingestion limit is 110MB, per seat, per day.

• Additional Data Retention is available for 1 year, by using the Threat Hunting Data Retention SKU/ Infinity Events SKUs.

• For more information, see sk182394.

Source: https://sc1.checkpoint.com/documents/Infinity_Portal/WebAdminGuides/EN/Harmony-Endpoint-Admin-Guide/... 

[MarcuzShinz]

I have one more question, so can we manual delete the logs on the cloud tenant harmony? because for now I still see the warning on tenant, but we have disable log record on some policy firewall.

[Chris_Atkinson]

Retention and Ingestion are separate issues, you may need to monitor for a period to see if the trend is reducing to the required level.

[lluner]

This link contains the information.

sk182394 - Cloud Log Analytics & Logging - Ingestion / Retention Solution

[Chris_Atkinson]

Worth checking that the desktop firewall policy isn't set to log 'everything' a common trap.