Endpoint protection that keeps enough device history to investigate an attack weeks later

You’re looking for endpoint detection and response (EDR)—not just antivirus—with searchable endpoint telemetry retained for at least a few weeks. I’d target 90 days so you have room for delayed discovery and investigation.

A few options to evaluate:

• Microsoft Defender for Endpoint: Microsoft documents a 90-day default for device timeline events, but Advanced Hunting queries cover only the last 30 days unless you stream data to Microsoft Sentinel and configure longer retention. Confirm which history you need to search and how it’s retained in your setup. (learn.microsoft.com)
• SentinelOne: Its current package comparison lists 14-day retention in one package and 90-day retention in higher tiers. Check that the 90-day tier includes the specific event history and investigation tools you need. (sentinelone.com)
• CrowdStrike Falcon: Falcon Search Retention is an option for keeping endpoint data for months or years, but it’s a separate retention capability—confirm the included retention in the quote. (crowdstrike.com)

Before buying, ask: “How many days can I search raw endpoint events—process execution, command lines, file/registry changes, and network activity—not just alerts?” Also ask whether retention is included, whether it applies to every device, and what happens when a subscription ends. A product’s advertised “data retention” may not mean every kind of telemetry is searchable for that long.

The short answer is SentinelOne with its extended retention add-on, or a managed service that keeps telemetry for a year. Retention varies a lot by tier, though, so check the exact number in a quote. Most base tiers keep data for days or weeks, not months.

Options that reach past 30 days

• SentinelOne: Its standard historical EDR retention is 14 days, with an upgrade to 365 days available. SentinelOne enables effective threat hunting with an industry leading data retention of 365 days out of the box for malware and fileless attack incidents. We offer 14 days standard historical EDR data retention with an affordable option to upgrade to 365 days. The add-on comes in tiers. Choose from 30, 90, 180, or 365-day options.
• Bitdefender GravityZone: Incident and alert data lasts 90 days. This period can be extended by enabling either the GravityZone EDR 180 days Data Retention Add-on, or GravityZone EDR 365 days Data Retention Add-on. Raw events are a different matter: by default, no data is retained.
• WatchGuard: New licenses from 1 April 2026 get 90 days for the Endpoint Security 360 and Elite tiers, and 30 days for Prime and Basic. Existing term licenses get a 365 days of data retention time extension until they expire.
• Microsoft Defender: The standard figure is 30 days (advanced hunting). For longer history, you would typically route data to Microsoft Sentinel or another SIEM.
• CrowdStrike: Sources disagree. One reviewer says standard tier retention caps at seven days, while a comparison article says CrowdStrike retains up to 90 days of raw telemetry with tamper-evident logs. A public contract document says data is kept in active storage for up to 90 days, and is deleted based on a rolling retention schedule. Each customer chooses their own retention period within the 90 day window. Longer history typically means buying an upgrade or LogScale, so confirm what your tier includes.
• Managed EDR (Red Canary example): After 14 days (or 7 days for Linux EDR), any telemetry data not related to a threat is moved to our AWS archival storage where it is retained for an additional 90 days. Confirmed threats are kept much longer. Confirmed threats and any associated Investigations are retained indefinitely.

Caveats

• Several of these figures come from vendor pages or review blogs, and they change. The WatchGuard change, for example, is recent. Get the retention figure in writing for the exact tier you buy.
• Retention is often the largest cost driver. Get every vendor to quote the same retention period 30 days minimum, 90 if your incident response process demands it.
• If you need to answer audit questions about logs from identity, network, or cloud, endpoint retention alone is not enough. An EDR cannot see everything, so you may also need a SIEM.

Suggested approach: Set a retention target first, since 90 days is a common safe choice for incident response. Then compare SentinelOne with its 365-day add-on, Bitdefender with its add-ons, and CrowdStrike or Defender with their longer-retention options, using quotes that all list the same retention period.

To investigate an attack that occurred weeks or even months ago, you need an Endpoint Detection and Response (EDR) or Extended Detection and Response (XDR) platform that supports long-term telemetry retention.

Many standard security products have short default retention periods (often 30 days), which is insufficient for "dwell times" where attackers remain undetected for weeks. To keep enough history for deep forensic investigation, you must specifically evaluate vendors based on their data retention policies and licensing tiers.

Key Considerations for Long-Term Investigation

• "Hot" vs. "Cold" Storage: Most EDRs use "hot" storage for real-time searching (e.g., 30–90 days). If you need data from 6+ months ago, ensure the vendor offers "cold" or archival storage, or allows you to export logs to a centralized data lake or SIEM (Security Information and Event Management) system.
• Storage Tiers: Some vendors provide standard retention but offer "add-on" licenses to extend telemetry storage to 180 or 365 days (e.g., Bitdefender, N-able, and Kaspersky).
• Cloud-Native Architecture: Cloud-native platforms are typically better at scaling to hold large volumes of historical data without significant performance degradation in search speeds compared to on-premise solutions.

Leading Solutions with Flexible/Extended Retention

While almost all top-tier EDR vendors provide some form of extended retention, the following are notable for their ability to handle long-term forensic data:

Recommended Action Plan

1. Check Your Current License: Do not assume your current tool is purging data at 30 days. Contact your account manager; you may only need to purchase an "extended retention" add-on rather than switching vendors.
2. Define Your Dwell Time Requirement: If your threat hunting or compliance requirements necessitate 6 months or 1 year of searchable history, ask vendors for their "Max Telemetry Retention"—not just their default.
3. Prioritize SIEM/Data Lake Export: For the longest-term investigations, rely on log forwarding. Most enterprise-grade EDRs (CrowdStrike, SentinelOne, Defender, etc.) allow you to stream raw telemetry to an external data lake (like Snowflake, Splunk, or Azure Data Explorer). This is often more cost-effective than paying the EDR vendor for "hot" storage of year-old data.
4. Test "Searchability": During a proof-of-concept (POC), do not just test live alerts. Specifically ask to query for a benign file or process that was executed 30+ days ago to ensure the historical search function remains performant and accessible.

If you’re evaluating endpoint protection specifically for investigating an attack weeks after it happened, compare the retention of searchable endpoint events and device timelines—not just how long alerts remain visible.

• Microsoft Defender for Endpoint: Device timeline events are retained 90 days by default, according to Microsoft’s investigation documentation. Advanced Hunting queries against native Defender data cover only 30 days; Microsoft says to use Sentinel or another configured storage destination for longer hunting history. ¹²
• CrowdStrike Falcon: A product datasheet describes up to 90 days of endpoint activity recall for Falcon Insight. For longer retention, CrowdStrike’s LogScale offers selectable periods such as 30, 60, 90, 180, or 365 days, subject to the relevant licensing and setup. ³⁴

Practical takeaway: Either may cover an investigation a few weeks later, but verify the exact telemetry you need is searchable for that long under your proposed plan. Ask vendors to confirm retention for process, file, registry, and network events, and whether it requires an add-on or external SIEM. Microsoft’s documented 180-day overall data retention shouldn’t be confused with its 30-day native Advanced Hunting query window. ²