Sentinel stores raw data and compressed event data on the local file system. You can configure Sentinel to store the data in a networked location for long-term storage.
The data files are deleted from the local and networked storage locations on a configured schedule. Raw data retention is governed by a single raw data retention policy. Data retention is governed by a set of event data retention policies. All of these policies are configured by the Sentinel administrator.