View source for State Management Policy configuration in Wazuh for Retention

[[Main Page | Home]] > [[Wazuh]] > [[State Management Policy configuration in Wazuh for Retention]]

= Index Retention =

Security standards require keeping data available for audits for a minimum period of time. For data older than this retention period, you might want to delete it to save storage space.

You can define specific policies to handle deletions automatically. These policies can also be used for index rollovers.

== Creating a Retention Policy ==

=== Step 1: Access State Management Policies ===

# Click on the upper left menu icon (☰).
# Navigate to '''Indexer Management'''.
# Select '''Index Management'''.
# Choose the tab '''State Management Policies'''.
# Click on the button '''Create policy'''.
# Select '''Visual editor''' as the configuration method.
# Click '''Continue'''.

=== Step 2: Define Policy Information ===

* In the '''Policy info''' section:
** Enter a unique name in the '''Policy ID''' field.  
   Example: <code>wazuh-alert-retention-policy</code>
** (Optional) Add a meaningful description in the '''Description''' field to clarify the policy's purpose.

=== Step 3: Assign ISM Template ===

* Click on '''Add template''' under the '''ISM templates''' section.
* Specify the index pattern to which this policy will apply.
  Example: <code>wazuh-alerts-*</code> 
* In the same way we can use this for archives index pattern
 <code>wazuh-archives-*</code>
* Leave the priority as the default value (1) or set a higher value if this policy should take precedence over others.

=== Step 4: Add Deletion State ===

* Click '''Add state''' to create a state responsible for deleting old indices.
** Enter a name for the state.  
   Example: <code>delete_alerts</code>

* Inside this state:
** Click '''Add action'''.
** From the '''Action type''' dropdown, select '''Delete'''.
** Click '''Add action''' to confirm.
** Click '''Save state''' to save the deletion state.

=== Step 5: Add Initial State ===

* Click '''Add state''' again to define the initial state.
** Enter a name.  
   Example: <code>initial</code>

* Reorder the states:
** Go to the '''Order''' tab.
** Choose '''Add before''' and select <code>delete_alerts</code>.

=== Step 6: Add Transition Condition ===

* Within the '''initial''' state:
** Click '''Add transition'''.
** Set the '''Destination state''' to <code>delete_alerts</code>.
** In the '''Condition''' section:
*** Select '''Minimum Index Age'''.
*** Enter the desired retention period.  
    Example: <code>90d</code> for 90 days.
** Click '''Add transition'''.

* Click '''Save state''' to save the initial state.

=== Step 7: Finalize Policy ===

* Click '''Create''' to finalize and save the policy.
* Change the '''Initial State''' of the policy to <code>initial</code> if not already set.

== ISM Policy States ==

At the end of this process, your policy should consist of:

* '''initial''' state:
** Waits for index to reach minimum age (e.g., 90 days).
** Transitions to <code>delete_alerts</code>.

* '''delete_alerts''' state:
** Deletes the index when conditions are met.

= Applying the Retention Policy to Alerts and Archives Indices =

After creating your Index State Management (ISM) retention policy, you need to apply it to the relevant indices — namely, the `wazuh-alerts-*` and `wazuh-archives-*` indices.

== Step-by-Step Instructions ==

=== 1. Open Index Management ===

# Click on the upper left menu icon (☰).
# Navigate to '''Indexer Management'''.
# Select '''Index Management'''.
# Go to the '''Indices''' tab.

=== 2. Apply Policy to Alerts Indices ===

# Locate and select the indices matching the pattern <code>wazuh-alerts-*</code>.
# Click on '''Actions''' → '''Apply policy'''.
# In the '''Apply policy to indices''' dialog:
## Select your previously created policy (e.g., <code>wazuh-alert-retention-policy</code>) from the '''Policy ID''' dropdown.
## Click '''Apply''' to bind the policy to the selected alert indices.

=== 3. Apply Policy to Archives Indices ===

# Locate and select the indices matching the pattern <code>wazuh-archives-*</code>.
# Click on '''Actions''' → '''Apply policy'''.
# In the dialog:
## Again, choose your retention policy (or a separate one created for archives).
## Click '''Apply''' to attach the policy to the archives indices.

== Notes ==

* You can apply the same policy to both alerts and archives if the retention period is the same.
* If you require a different retention duration for archives, create a separate ISM policy (e.g., <code>wazuh-archives-retention-policy</code>) and repeat the steps above.