Since system intrusions take place over a very short period of time,there is no need to maintain IDPS log data for more than a few hours.

Question

Quizplus · Accepted Answer

Maintaining IDPS log data for more than a few hours is important for forensic analysis and investigation into the system intrusion, identifying the attacker or the vulnerability exploited, and preventing future attacks. Retaining log data for longer periods also helps in meeting compliance and regulatory requirements.

Since System Intrusions Take Place Over a Very Short Period