Data Retention, Privacy, and Security Administration
This domain tests data retention, privacy, and security administration: how long telemetry is kept, what sensitive data leaves the monitored host, and how access is protected.
Retention
Retention differs by data type and by SaaS or self-hosted deployment. Metrics, traces, and events can have different windows; administrators set or confirm them in tenant settings or self-hosted configuration. Retention affects dashboards and investigations, so document it and align it with audit requirements.
Privacy controls
Agents can capture HTTP headers, URLs, query parameters, and payloads. Minimize collection: mask or drop sensitive headers and query parameters, disable payload capture for regulated services, and exclude endpoints that carry secrets. Treat agent keys, API tokens, and support bundles as sensitive.
Security administration
Use TLS for agent-to-backend traffic, restrict outbound destinations, rotate agent keys, and review audit logs. Enforce SSO and least privilege. For self-hosted installations, secure the backend, databases, and object storage, and patch regularly.
Worked example
A payment service sends Authorization and token data in URLs. Configure the agent to mask the authorization header and token query parameter, disable request and response payload capture for that service, then verify in a trace that values are redacted before increasing retention.
Traps
Assuming SaaS keeps data forever, putting agent keys in Git, disabling TLS verification to fix a proxy, and downloading support bundles without reviewing contents are common mistakes.