FAQ: What is the difference between raw and contributing events?

Raw events – All events ingested by Threat Stack. Threat Stack retains raw events according to your company’s retention policy – a period of one or three days.

Contributing events – Events that trigger alerts. Threat Stack retains contributing events for one calendar year from the date of the triggered alert.