Define Retention Rules

Administrators can define and order retention rules for log storage collections on an Archiver. Retention rules specify the type of logs to be stored in the collection. For your log collections to gather and store log data, you must associate them with at least one retention rule. When you configure a retention rule, you specify a condition and a collection for that rule. The condition (rule definition) determines the type of logs stored in that collection.

For the condition, you can use anything that works in a regular query where clause.

For example, to get logs from compliance services, you can use the following condition:

device.group='PCI Devices' || device.group='HIPPA Devices'

After you define the retention rules for your collections, it is important that you specify the order of your retention rules. NetWitness evaluates the retention rules for all of the collections in numerical order by the number listed in the Order column in the Retention Rule section of the Data Retention tab of the Archiver ( netwitness_adminicon_25x22.png (Admin) > Services Config view).

netwitness_retrl1_738x143.png

Caution: Rule order is very important. It determines the priority for evaluating the log data for storage retention.

Prerequisites

Before you configure your retention rules:

  • Configure total hot, warm, and cold storage
  • Configure log storage collections

Procedures

Define a Retention Rule for a Collection

  1. Go to netwitness_adminicon_25x22.png (Admin) > Services, click netwitness_filericon.png, and select Archiver.

  2. In the Actions column, click netwitness_ic-actns.png > View > Config.

    The Services Config view of Archiver is displayed with General tab open.

  3. Click the Data Retention tab, in the Retention Rules section, click netwitness_ic-add.png.

    The Rule Definition dialog is displayed.

    netwitness_ruledef.png

  4. Configure the fields in the Rule Definition dialog as described in the following table:

    Field Description
    Rule Name Specify a unique name for your retention rule. It cannot include spaces. For example: LowValueWinLogs
    Condition

    Specify the conditions for the type of logs that you want to include in the collection.

    All string literals and time stamps must be quoted. Do not quote number values and IP addresses.

    For example:

    device.type='winevent_nic' && msg.id='security_4648_security'
    Collection Select the collection on which you want to apply this rule. For example: LowValue.

  5. Click Save.

    The retention rule that you define becomes associated with the collection you selected. On the Data Retention tab, in the Collections section, you can click netwitness_actions_icon_40x24.png > Select Rules in the Actions column for the selected collection to view the retention rules associated with the collection in the Retention Rule section.

    netwitness_retrulsec.png

Specify the Order of your Retention Rules

To prioritize the complete list of all of your retention rules:

  1. In the Retention Rules section of the Data Retention tab, select a retention rule and use drag and drop (or select netwitness_ic-up.png Move Up and netwitness_ic-down.png Move Down) to change its order in the priority list.

    netwitness_retrulordr_701x159.png

  2. Click Apply to save the order of the retention rules.

Caution: Rule order is very important. It determines the priority for evaluating the log data for storage retention.