Delete Indicators Manually

Ambiguous hunting rules can generate a large number of indicators that can be false positives. This excessive noise can overload Tier 1 analysts when triaging. To avoid this situation, Cytomic Orion enables you to move indicators manually to the recycle bin.

Required Permissions

To delete indicators and manage indicator deletion rules, the analyst account must have the Delete indicators and manage automatic indicator deletion rules permission assigned to the account role. For more information about roles and permissions, see Understanding Permissions.

Move One or More Indicators to the Recycle Bin

• Select the checkboxes for the indicators you want to delete. You can delete only indicators that have the Pending status.

• In the toolbar, select Delete . The indicators are automatically moved to the Deleted manually section of the bin.

Indicators marked as Deleted are held in the recycle bin for seven days. After that time, they are permanently removed from Cytomic Orion.