Data Retention in your Google Security Operations account

By default, Google retains twelve months of your data in your Google Security Operations account. This retention period can be extended as part of your Purchase Order. The retention period applies to all of the data in your Google Security Operations instance. For example, you can't modify the data retention policy for a specific log type.

Google uses an automated system to remove historical data based on event and detection timestamps.

Note: It may be possible to see extended events at the margins of the retention period. For example, if a detection includes component events marginally older than the retention period.

For more information, see Google Security Operations pricing.