> For the complete documentation index, see [llms.txt](https://docs.vectra.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.vectra.ai/operations/investigate/vectra-ai-platform-investigate-faq.md). # Vectra AI Platform Metadata Retention FAQ ## FAQ #### 1. What is Vectra AI metadata retention? Metadata retention unlocks deeper investigations, flexible hunting, and a broad set of observability insights across Vectra AI monitored attack surfaces. #### 2. How do I access metadata retention? Metadata retention is available in the new Vectra AI experience and is enabled at specific Vectra AI license levels. Retention can be increased up to 180 days. Contact your Vectra AI account team to learn more. #### 3. How long can historical data be stored? The retention period is the maximum number of days during which data is searchable in the Vectra AI Platform. Retention can be increased for up to 180 days. #### 4. Is there a limit to the number of results rendered in a search? Yes. The UI renders up to 10,000 results per query. #### 5. Is there a limit to the number of results downloaded in the CSV file from a search? The search download feature exports the same number of results rendered in the UI. If a search reaches the 10,000-result limit, the CSV download also contains 10,000 results. #### 6. What is a Vectra AI enriched field? Enriched metadata fields contain additional information or attributes that, when added to the existing metadata of a network or security event, provide more context and insight into the event. Typically, enriched metadata fields are derived from advanced analysis techniques, machine learning algorithms, or other data enrichment processes. #### 7. What network metadata is enriched with host information? Network metadata is enriched with the name of the host associated with the traffic, when available, for the most recent 30 days of traffic. Traffic from hosts with detections is enriched for 60 days. Beyond 30 days, non-enriched host names appear as `null`. #### 8. How do I filter my network metadata using a sensor? Filter network metadata using the `sensor_uid` field. #### 9. How do I filter using CIDR notation? To use CIDR notation, add a filter for any IP address field and specify the filter `in (CIDR notation)`. #### 10. Where can I see the metadata types available? Metadata for all available for all monitored domains, e.g. Network, Entra ID, M365, AWS Control Plane, and Azure Control Plane. * Network: [Vectra AI Platform Network Metadata](/reference/metadata-attributes/vectra-ai-platform-network-metadata-attributes.md) * Entra ID (Azure AD) and M365: [Vectra AI Platform Azure AD and M365 Metadata](/reference/metadata-attributes/vectra-ai-platform-azure-ad-and-m365-metadata-attributes.md) * AWS Control Plane: [Vectra AI Platform AWS CloudTrail metadata](/reference/metadata-attributes/vectra-ai-platform-aws-cloudtrail-metadata-attributes.md) #### 11. Are there Vectra enriched fields for AWS metadata? Yes. The Vectra enriched metadata field in AWS is called `Vectra.entity.Resolved_Identity.Canonical_Name`. In AWS, a user or service often performs actions using an assumed role. In the metadata, this is reflected by a value in the `assumedRole` field. Vectra automatically attributes CloudTrail events to the original entity that initiated the action instead of an intermediate or temporary access key or role. This provides the visibility needed for a successful investigation and exposes that value in `Vectra.entity.Resolved_Identity.Canonical_Name`. #### 12. Are there Vectra AI enriched fields for AAD and M365 metadata? The enriched field in Azure AD and M365 data streams is `VECTRA.IDENTITY_PRINCIPAL`. It identifies the normalized identity performing the action accross available logs for faster searching. #### 13. Which Microsoft license do I need to collect all the metadata needed for AAD and M365 Instant Investigation? Microsoft requires a P1 license for access to SignIn and Directory Audit logs. No other log types are limited by Microsoft licenses. #### 14. Why do I get an error message in Instant Investigation for Azure AD and M365 that says I may not have the required Microsoft license? Microsoft requires a P1 license for access to Azure AD SignIn and Directory Audit logs. If you don’t have that license in your deployment, Instant Investigation won’t be able to provide results for the SignIns and Directory Audit data streams. #### 15. What search period is selected by default after I click the Instant Investigation tab? When accessing the Instant Investigation tab for a host or an account, the default time selected is 6 hours prior to the last active detection. If the last active detection falls outside the retention period, the default search will instead be set to 6 hours before the moment the Instant Investigation page is accessed ('now'). --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.vectra.ai/operations/investigate/vectra-ai-platform-investigate-faq.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.