Data Loss Prevention

Expand all | Collapse all

Incident attachments are not deleted

  • 1.  Incident attachments are not deleted

    Posted 11-16-2020 08:49 AM
    Hi community,

    in the incident deletion process no attachments are being deleted.

    Do you know of a script or somewhat to check the consistency?


  • 2.  RE: Incident attachments are not deleted

    Broadcom Employee
    Posted 11-17-2020 01:12 PM
    Do you know if these incidents were violations for a policy that has a response rule including "Limit Incident Data Retention?"

    You may not have any attachment data associated with the deleted incidents. In which case, this would be the normal output for the incident deleter.

    If you're certain you have attachment data associated with these incidents, do you have external attachments enabled?


  • 3.  RE: Incident attachments are not deleted

    Posted 11-18-2020 02:53 AM
    All endpoint rules have incident data retention, in some cases keeping all the attachments as well.

    files are in the database and can be downloaded. when you select one of those incidents to delete we will have the same outcome.

    no external incidents used as this is 14.6 - we have to migrate and stuck in process since summer as broadcom support did not help in checking db consistency

    ------------------------------
    PMCS GmbH & Co. KG
    ------------------------------



  • 4.  RE: Incident attachments are not deleted

    Broadcom Employee
    Posted 11-23-2020 11:17 AM
      |   view attached
    In my experience, the column for files/attachments only populates when you choose to retain the original message but choose to delete attachment data from the incident. So, if you are completely deleting the incidents, then this would be the intended outcome.