FAQ: What is the difference between raw and contributing events?


Raw events – All events ingested by Threat Stack. Threat Stack retains raw events according to your company’s retention policy – a period of three, five, or seven days.

Contributing events – Events that trigger alerts. Threat Stack retains contributing events for one calendar year from the date of the triggered alert.

Was this article helpful?
0 out of 0 found this helpful
Have more questions? Submit a request



Please sign in to leave a comment.