How to retain incident but delete original message(s)/attachment(s) from the Enforce UI
From the Incidents page, check the incident to be deleted and click on Incident Actions.
Choose Delete Incidents
On the Delete Incidents page under Delete Options..choose Retain incidents but Delete Original Message(s)/Attachment(s) file(s).
Delete Original Message works only for Network incidents. Doesn't apply for Endpoint incidents.
The deletion will actually happen after the oracle batch process runs at midnight to delete it from the database.
To verify if you click on the attachment of the aforesaid incident, it will give a pop up message: "The attachment is discarded."