> For the complete documentation index, see [llms.txt](https://docs.vectra.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.vectra.ai/operations/event-search/vectra-ai-platform-investigate-faq.md). # Vectra AI Platform Metadata Retention FAQ FAQ for Vectra AI metadata retention for observability, hunting, and investigations. ### What is Vectra AI metadata retention? Metadata retention unlocks deeper investigations, flexible hunting, and a broad set of observability insights across Vectra AI monitored attack surfaces. ### How do I access metadata retention? Metadata retention is available in the new Vectra AI experience and is enabled at specific Vectra AI license levels. Retention can be increased up to 180 days. Contact your Vectra AI account team to learn more. ### How long can historical data be stored? The retention period is the maximum number of days during which data is searchable in the Vectra AI Platform. Retention can be increased for up to 180 days. ### Is there a limit to the number of results rendered in a search? Yes. The UI renders up to 10,000 results per query. ### Is there a limit to the number of results downloaded in the CSV file from a search? The search download feature exports the same number of results rendered in the UI. If a search reaches the 10,000-result limit, the CSV download also contains 10,000 results. ### What is a Vectra AI enriched field? Enriched metadata fields contain additional information or attributes that, when added to the existing metadata of a network or security event, provide more context and insight into the event. Typically, enriched metadata fields are derived from advanced analysis techniques, machine learning algorithms, or other data enrichment processes. ### What network metadata is enriched with host information? Network metadata is enriched with the name of the host associated with the traffic, when available, for the most recent 30 days of traffic. Traffic from hosts with detections is enriched for 60 days. Beyond 30 days, non-enriched host names appear as `null`. ### How do I filter my network metadata using a sensor? Filter network metadata using the `sensor_uid` field. ### How do I filter using CIDR notation? To use CIDR notation, add a filter for any IP address field and specify the filter `in (CIDR notation)`. ### Where can I see the metadata types available? Metadata for all available for all monitored domains, e.g. Network, Entra ID, M365, AWS Control Plane, and Azure Control Plane. Vectra AI Platform Metadata Descriptions * [Vectra AI Platform Network Metadata](/reference/metadata-attributes/vectra-ai-platform-network-metadata-attributes.md) * [Vectra AI Platform Azure AD and M365 Metadata](/reference/metadata-attributes/vectra-ai-platform-azure-ad-and-m365-metadata-attributes.md) * [Vectra AI Platform AWS CloudTrail metadata attributes and descriptions](/reference/metadata-attributes/vectra-ai-platform-aws-cloudtrail-metadata-attributes.md) * [Vectra AI platform Azure metadata attributes and descriptions](/reference/metadata-attributes/vectra-ai-platform-azure-metadata-attributes.md) ### Are there Vectra enriched fields for AWS metadata? Yes. The Vectra enriched metadata field in AWS is called `Vectra.entity.Resolved_Identity.Canonical_Name`. In AWS, a user or service often performs actions using an assumed role. In the metadata, this is reflected by a value in the `assumedRole` field. Vectra automatically attributes CloudTrail events to the original entity that initiated the action instead of an intermediate or temporary access key or role. This provides the visibility needed for a successful investigation and exposes that value in `Vectra.entity.Resolved_Identity.Canonical_Name`. ### Are there Vectra AI enriched fields for AAD and M365 metadata? The enriched field in Azure AD and M365 data streams is `VECTRA.IDENTITY_PRINCIPAL`. It identifies the normalized identity performing the action accross available logs for faster searching. ### Which Microsoft license do I need to collect all the metadata needed for AAD and M365 Instant Investigation? Microsoft requires a P1 license for access to SignIn and Directory Audit logs. No other log types are limited by Microsoft licenses. ### Why do I get an error message in Instant Investigation for Azure AD and M365 that says I may not have the required Microsoft license? Microsoft requires a P1 license for access to Azure AD SignIn and Directory Audit logs. If you don’t have that license in your deployment, Instant Investigation won’t be able to provide results for the SignIns and Directory Audit data streams. ### What search period is selected by default after I click the Instant Investigation tab? When accessing the Instant Investigation tab for a host or an account, the default time selected is 6 hours prior to the last active detection. If the last active detection falls outside the retention period, the default search will instead be set to 6 hours before the moment the Instant Investigation page is accessed ('now'). --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.vectra.ai/operations/event-search/vectra-ai-platform-investigate-faq.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.