Deleting incidents

To delete incidents, you must be a Global Security Administrator or Super Administrator.

Important: You cannot undo this action.

To delete selected incidents:

  1. Select the incidents to delete.
  2. From the toolbar, select Workflow > Delete > Selected Incidents.
  3. From the Reason menu, select a reason for the action.
  4. Click OK to confirm the action.

To delete all report incidents:

  1. Set your report filters as desired. To do so, select Manage Report > Edit Filter.
  2. When the report contains all the incidents you want to delete and no more, select Workflow > Delete > Report Incidents from the toolbar.
  3. From the Reason menu, select a reason for the action.
  4. Click OK to confirm the action.

If you are deleting mobile or network DLP incidents, you can continue working while the operation runs in the background.

When incidents are deleted, their forensics are deleted from the forensic repository.

If the system is set up to do so, an email message is sent to all configured recipients notifying them that incidents were deleted from the incident database.

Incident deletions are also logged in the Audit Log, showing who deleted the incidents, when, and why.