Delete all incidents for a particular policy or time range in DLP

Products

• Data Loss Prevention Enforce
• Data Loss Prevention

Issue/Introduction

You need to delete incidents based on time range or other criteria.

There are many thousands of incidents that were generated due to overly broad policy rules and you need to delete them.

You are unable to delete a policy thru the Enforce UI due to the system saying that there are still incidents tied to the policy.

Resolution

As a general rule, all incidents should be deleted through the Enforce UI.  However, there are times when a more direct method is needed.  Perhaps you have many thousands of incidents that get created based on overly broad rules for a particular policy.  For example, you may have set up a policy that generates 80,000 incidents.  You want to remove the incidents and revamp the policy, or you may be unable to delete a policy because there are still incidents tied to that particular policy.  In those instances, please contact Broadcom Support for next steps.