Is unfiltered raw data stored when applying Filters in Panther?
QUESTION
Is unfiltered raw data stored when applying raw event filters in Panther?
ANSWER
Yes, unfiltered log data gets stored in the dataArchive bucket which is the same bucket that can be used to infer schemas from existing log data. However, this data does not count toward any ingestion costs or storage.