deft/notes/cisco_iroh_client_data_retention.org

Cisco IROH Client Data Retention

• Recommendation

tags

source

Recommendation

As a client of XDR API (IROH) you can retrieve the Data Retention policy using multiple APIs. But the recommended API to use is /iroh/profile/whoami (See link in TEST: https://visibility.test.iroh.site/iroh/profile/index.html#/Profile/get_iroh_profile_whoami)

You should call this API using an IROH access token that you could retrieve using the refresh token you should already have for your customer.

Inside this HTTP call, the body of the request should looks like:

{
  "user": {...},
  "org": {
    ...
    "entitlement-summary": {
      "tier": {"title": "advantage", ...},
      "extra_data_retention": {...},
      "extra_ingest": {...},
      "techvals": {
        "data-retention-in-days": 180,
        "data-maximal-size-in-GB": 30,
        ...
      }
    }
  }
}

The recommended method to retrieve the number of days is to use org["entitlement-summary"]["techvals"]["data-retention-in-days"] value. Note for some org the entitlement summary will not be provided entirely as some XDR org do not have any entitlements (beta orgs, test orgs, not yet sync with PIAM, etc…)

For these cases we do not provide any default number of day.