FAQ: What is the difference between raw and contributing events?

Follow

Raw events – All events ingested by Threat Stack. Threat Stack retains raw events according to your company’s retention policy – a period of three, five, or seven days.

Contributing events – Events that trigger alerts. Threat Stack retains contributing events for one calendar year from the date of the triggered alert.