Retain incidents - Retain up to 1000 incidents. - Administrator Guide - 8.13 - Cortex XSOAR - Cortex - Security Operations

You can mark up to 1000 incidents for permanent retention so that any important incidents can't be inadvertently deleted manually, or by an API call. Retained incidents are never deleted. If you reach 1000 retained incidents, you won't be able to add additional incidents, unless you disable incident retention for some or all of your existing retained incidents.

Only user roles that have the Retain incident permissions, can retain or undo incident retention. For more information, see Role-based permissions.