Sentinel stores raw data and compressed event data on the primary location. You can configure Sentinel to store the data in a secondary location for long-term storage.
The data files are deleted from the primary and secondary storage locations on a configured schedule. Raw data retention is governed by a single raw data retention policy. Data retention is governed by a set of event data retention policies. All of these policies are configured by the Sentinel administrator.