What can you do if you need a longer EAM retention period than the default of 7 days?

If you need a longer Endpoint Activity Monitoring (EAM) retention period than the default 7 days, consulting with a Service Account Manager is the proper approach. This individual typically has the expertise to assess your request and facilitate adjustments to your service terms as necessary. They can help negotiate or provide guidance on modifying the retention policy in accordance with organizational policies and service agreements.

This option demonstrates the importance of communication with specialized roles within the organization that manage Falcon services and configurations. Engaging the Service Account Manager ensures that any changes consider business requirements, compliance issues, and technical feasibility.

Other alternatives like directly modifying the retention policy may not be possible due to permissions and governance in place, as retention settings are usually managed at a higher administrative level. Requesting additional features from IT might not address the specific need for retention period adjustments as directly or effectively as working with a Service Account Manager. Utilizing third-party software could introduce unnecessary complexity and potential security concerns, diverting from the native capabilities of the CrowdStrike Falcon platform. Thus, consulting with a Service Account Manager provides the most structured and compliant pathway for extending EAM retention periods.