Process Guard receives events from the endpoints for each unique process attempt to access LSASS. These events are stored in the Endpoint Security database for a finite period, after which they are discarded. Use the Data Aging Settings to specify how long to retain events. The default value is 30 days.
Data Aging
- Published on Sep 11, 2026
- 1 minute(s) read
Was this article helpful?