ok I noticed now that you already opened the PR so let's keep the retention management for IOCs and Command Sequences too. I would put a higher value as default (10 years)

Two important considerations:

• CowrieSession serves as the n:m relationship bridge between IOC and CommandSequence objects. Deleting a session removes the association between an IOC and the commands it executed during that session.
• With 10 years of CommandSequence data, clustering may become too computationally expensive due to the time complexity of these algorithms.

CowrieSession serves as the n:m relationship bridge between IOC and CommandSequence objects. Deleting a session removes the association between an IOC and the commands it executed during that session.

Because of that, I would keep CowrieSessions with at least one associated command alive for more time.
If the CommandSequence objects are deleted on cascade with CowrieSessions, does it make sense to clean that table too directly? (Maybe I am missing something so please tell me if you see any flaw)

With 10 years of CommandSequence data, clustering may become too computationally expensive due to the time complexity of these algorithms

Ok so nevermind, I am more interested in keeping a long retention for the IOC itself

Because of that, I would keep CowrieSessions with at least one associated command alive for more time.

Yes. I think it is sensible to keep them at least as long as they have an associated command.

If the CommandSequence objects are deleted on cascade with CowrieSessions, does it make sense to clean that table too directly? (Maybe I am missing something so please tell me if you see any flaw)

CommandSequence objects are NOT deleted on cascade. One CommandSequence can be executed by multiple IOCs. If we would cascade delete it with the deletion of a single CowrieSession, that would also delete it for Sessions from other IOCs, which is not what we want.

Conclusion:

• we set IOC_RETENTION to 3650 (10y)
• we leave the default for COWRIE_SESSION_RETENTION and COMMAND_SEQUENCE_RETENTION at 365
• we only delete CowrieSessions if they have no associated CommandSequence (either because they never had one or because it got cleaned up)

Do you agree?

super!