What is the default LOG retention period in a Harmony Endpoint Advanced license?

[Mitja-S3NEXT]

What is the default LOG retention period in a Harmony Endpoint Advanced license?

(LOG, not AUDIT LOG)

[the_rock]

Im fairly sure its 90 days.

[Mitja-S3NEXT]

No, thats surely not.
I can see LOGs from 2023. But what I need to know is the exact limitation.

[the_rock]

I was thinking of something else then. Lets see if someone can confirm for sure. Maybe if you check with Account services, they might be able to verify as well.

[Mitja-S3NEXT]

That would be very nice.

[the_rock]

If I were you, would call Account services folks, just give them your UC account number and Im positive they will give you the right info. I always find them to be extremely helpful when I call.

[Chris_Atkinson]

Correct 90 days is default (for Cloud Managed) per:

https://sc1.checkpoint.com/documents/Infinity_Portal/WebAdminGuides/EN/Harmony-Endpoint-Admin-Guide/...

[Mitja-S3NEXT]

Any idea, why I see LOGs from 2023, I attached a screenshot?
Maybe I forgot to mention it is the CLOUD version of Endpoint.

[Chris_Atkinson]

Do you have any of the retention license extensions in place per: sk182394 ?

[Mitja-S3NEXT]

No, everything is default, the license is Harmony Endpoint Advanced,

[PhoneBoy]

I would check with TAC on this, honestly. 

[the_rock]

Hey mate,

Were you able to find the answer to this?

[Mitja-S3NEXT]

Unfortunately not.

[the_rock]

Did you open Account services case?

[Mitja-S3NEXT]

It is a sales related technical question. 

[the_rock]

I would still see if Account services would know, if not, they can refere you to your SE.

[Mitja-S3NEXT]

I opened now a TAC, i will keep this post updated.

[the_rock]

Please keep us posted.

[Mitja-S3NEXT]

This is the TAC response:

----------------------------------------------------------------------

Thank you for contacting Check Point Account Services.

Please note that while Account Services is happy to assist with any licensing and/or User Center related issues, we are a post-sales team only and therefore do not handle sale related issues.

[the_rock]

K, so then I suppose only other logical option would be your local SE.

[Mitja-S3NEXT · Accepted solution]

SK and admin guide for more information: 

• Harmony Endpoint Logs
• sk182394 - Cloud Log Analytics & Logging - Ingestion / Retention Solution

1. Audit Logs

• Retention Period: Audit logs in Infinity Portal are kept for a minimum of one year (12 months), regardless of license.
• Reference:

  "Audit logs are kept on record for a minimum of one year."
  (Infinity Portal Administration Guide)

2. Operational/Event Logs (All Other Logs)

• Retention Period:
  • The default and guaranteed retention period for operational/event logs (including security events, endpoint activity, etc.) is determined by your Harmony Endpoint license.
  • For most standard licenses, this period is 90 days.
• What Happens After Retention Period?
  • After the retention period (e.g., 90 days), logs are deleted and cannot be recovered from the Infinity Portal.
  • There is no official documentation confirming that operational/event logs are kept longer than the licensed retention period, even if you see some logs older than 90 days in the UI. This may be due to backend processing delays or exceptions, but you should not guarantee longer retention to customers.

3. NIS2 Compliance (180 Days)

• Requirement: NIS2 requires all logs (not just audit) to be retained for at least 180 days.
• Check Point Guarantee:
  • Unless you have a specific license or agreement for 180-day retention, Check Point only guarantees the retention period defined in your license (typically 90 days).
  • If you need to guarantee 180 days, you must:
    • Upgrade your license to a plan that supports 180-day retention (if available).
    • Export logs regularly to external storage (e.g., SIEM, Azure Storage, etc.) for long-term retention.

4. Forwarding/Exporting Logs

• Infinity Portal allows forwarding logs to external storage (e.g., Azure Storage), but note:
  • The storage account retains data for only 7 days by default (unless you configure longer retention on your storage solution).
  • You are responsible for managing retention in external systems.

Check Point guarantees log retention for the period defined in your license. For most customers, this is 90 days for all operational/event logs and 1 year for audit logs. If you require 180-day retention for NIS2 compliance, you must either upgrade your license or regularly export your logs to an external system for long-term storage.
 

[the_rock]

Thanks for updating us!