What is the maximum number of retention buckets that can be configured for shared data in QRadar?

In IBM QRadar, the maximum number of retention buckets that can be configured for shared data is 10. This concept of retention buckets plays a crucial role in the storage management of data within the SIEM. Each retention bucket represents a different period where data can be retained according to specific criteria set by the user or administrator.

Having a limit of 10 retention buckets allows for a structured approach to managing how long data is kept and when it should be archived or deleted. This helps organizations comply with various data retention policies and regulations while also optimizing the performance of the SIEM by managing data volume effectively.

Understanding this limit is essential for effective planning and implementation of data retention strategies within QRadar, ensuring that security events are appropriately stored and managed according to organizational needs.