execute retention-setting

Use this command to set the Time-to-Live (TTL) for FortiNDR log tables. The setting applies in both standalone and sensor modes and persists across reboots and power cycles.

Syntax

execute retention-setting <'service name'> <retention days>

Variable	Description
'service name'	The specific retention category for FortiNDR data. Valid options (enclosed in single quotes): Network Events File Events Machine Learning Data
retention days	Number of days to retain data. Must be an integer between 1 and 264 (inclusive). Default values: 264 days for Network Events and File Events 7 days for Machine Learning Data

Example

execute retention-setting 'Network Events' 90

The command enforces the software’s supported limits and helps estimate data retention based on average AV and NDR throughput across VM and physical models.