FAQ: What is the difference between raw and contributing events?
Raw events – All events ingested by Threat Stack. Threat Stack retains raw events according to your company’s retention policy – a period of one or three days.
Contributing events – Events that trigger alerts. Threat Stack retains contributing events for one calendar year from the date of the triggered alert.