Documentation | Support

Go to the table of contents Go to the previous page Go to the next page View or print as PDF
Viewing Incidents and Reports > Viewing the incident list > Managing incident workflow > Deleting incidents
Deleting incidents
Administrator Help | Forcepoint DLP | Version 8.4.x
With Forcepoint DLP, you can delete incidents that are known to be false positives or that are the product of a policy that is no longer relevant to your organization. There may be other reasons as well, depending on your security policies and practices.
*
You can delete selected incidents.
*
For discovery and mobile DLP, you can delete all incidents at once. Choosing this option deletes all discovery incidents or all mobile DLP incidents in the system (depending on your selection).
*
For network, endpoint, and mobile DLP, you can delete all the incidents in the current report. For example, you can create a report that lists all email incidents originating from your company president, and then delete all those incidents in a single batch operation.
To delete incidents, you must be a Global Security Administrator or Super Administrator.
 
* 
Important 
You cannot undo this action.
To delete selected incidents:
1.
Select the incidents to delete.
2.
From the toolbar, select Workflow > Delete > Selected Incidents.
3.
When prompted, select a reason for the action—for instance, the incidents are false positives or no longer relevant. If you choose Other, enter a reason for the deletion in the field provided.
4.
Click OK to confirm the action.
To delete all the incidents in the report (network, endpoint, and mobile DLP only):
1.
Set your report filters as desired. To do so, select Manage Report > Edit Filter.
2.
When the report contains all the incidents you want to delete and no more, select Workflow > Delete > Report Incidents from the toolbar.
3.
When prompted, select a reason for the action—for instance, the incidents are false positives or no longer relevant. If you choose Other, enter a reason for the deletion in the field provided.
4.
Click OK to confirm the action.
To delete all incidents (discovery and mobile DLP only):
1.
From the toolbar, select Workflow > Delete > All Mobile Incidents / All Discovery Incidents.
2.
For mobile DLP, skip to step #3. For discovery, select a reason for the action when prompted—for instance, the incidents are false positives or no longer relevant. If you choose Other, enter a reason for the deletion in the field provided.
3.
Click OK to confirm the action.
If you are deleting mobile or network DLP incidents, you can continue working while the operation runs in the background.
When incidents are deleted, their forensics are deleted from the forensic repository.
If the system is set up to do so, an email message is sent to all configured recipients notifying them that incidents were deleted from the incident database.
Incident deletions are also logged in the Audit Log, showing who deleted the incidents, when, and why.

Go to the table of contents Go to the previous page Go to the next page View or print as PDF
Viewing Incidents and Reports > Viewing the incident list > Managing incident workflow > Deleting incidents
Copyright 2017 Forcepoint. All rights reserved.