All endpoint rules have incident data retention, in some cases keeping all the attachments as well.
files are in the database and can be downloaded. when you select one of those incidents to delete we will have the same outcome.
no external incidents used as this is 14.6 - we have to migrate and stuck in process since summer as broadcom support did not help in checking db consistency
------------------------------
PMCS GmbH & Co. KG
------------------------------
Original Message:
Sent: 11-17-2020 01:12 PM
From: Justin Taylor
Subject: Incident attachments are not deleted
Do you know if these incidents were violations for a policy that has a response rule including "Limit Incident Data Retention?"
You may not have any attachment data associated with the deleted incidents. In which case, this would be the normal output for the incident deleter.
If you're certain you have attachment data associated with these incidents, do you have external attachments enabled?
Original Message:
Sent: 11-16-2020 08:48 AM
From: Henning Dey
Subject: Incident attachments are not deleted
Hi community,
in the incident deletion process no attachments are being deleted.