Data Lake storage limits

There are limits on how much data you can store in the Sophos Data Lake and how long it's stored.

The Sophos Data Lake stores data for up to 90 days for XDR customers, or up to 30 days for EDR customers.

We limit the data that devices can store as follows:

• A daily limit for one device.
• A 90-day limit for all your devices (XDR), or a 30-day limit for all your devices (EDR).

Daily limit for one device

Each device is limited to uploading a maximum of 2 GB of data per day.

When a device reaches the limit, it stops uploading data until the limit resets. Data that the device doesn’t upload to the Data Lake during this time won’t be sent later. You can only query that data directly on the device.

For Windows devices, the limit resets at midnight local time.

For Linux devices, the limit resets every 24 hours after the XDR agent has started.

All other communications between your devices and Sophos, including threat alerts, continue as usual.

If your devices are uploading more data than you expect, you can find out which of your queries are generating the most data. You can then use this information to investigate your data uploads. See Troubleshoot daily limit breaches.

90-day or 30-day limit for all your devices

The Data Lake stores data for up to 90 days for XDR, or up to 30 days for EDR. The total storage allowed during that time is based on the number of licenses.

There are separate storage pools for endpoints and servers:

• The endpoint pool can have 20 MB per license per day (1.8 GB per XDR license per 90 days).
• The server pool can have 40 MB per license per day (3.6 GB per XDR license per 90 days).

If devices exceed these limits, the Data Lake won't be able to make the data for the full time period available to query.

How device limits work

Suppose you have the following Sophos XDR licenses.

• 10 Sophos XDR - User
• 10 Sophos XDR - Server

During a 90-day period, you can store the following amounts of data.

• Up to 18 GB of endpoint data (10 licenses x 20 MB x 90 days)
• Up to 36 GB of server data (10 licenses x 40 MB x 90 days)

If you exceed a storage limit, we remove the oldest data until your data is under the limit.

For example, if your endpoints upload 40 MB per day (twice the average allowed across the month), they reach the limit after only 45 days. We then start to remove the oldest data, so you can't query the full 90 days of historic data.

However, if your devices upload less than the maximum amount allowed, we still only store their data for 90 days.