Firepower Security Intelligence One Day

[craneman]

How can we increase the retention within Firepower for Security Intelligence events? They don't seem to last more than a day.

[balaji.bandi]

how about increasing to the maximum events depends on model and kit.

https://www.cisco.com/c/en/us/support/docs/security/firesight-management-center/118012-troubleshoot-firesight-00.html

[Marvin Rhoads]

In FMC the options under System > Configuration > Database control the various tables and divide up the various databases across the system capacity (which is platform-dependent). In those settings you should see within the Connection Database a value for "Maximum Security Intelligence Events". On an FMCv the default value is 1 million events.