Retain incidents

Retain incidents in Cortex XSOAR 8.10 On-prem.

You can mark up to 1000 incidents for permanent retention so that any important incidents can't be inadvertently deleted manually, or by an API call. Retained incidents are never deleted. If you reach 1000 retained incidents, you won't be able to add additional incidents, unless you disable incident retention for some or all of your existing retained incidents.

Only user roles that have the Retain incident permissions, can retain or undo incident retention. For more information, see Role-based permissions.

Retain an incident

1. On the Incidents page, click the incident you want to retain.
2. From the Actions dropdown button in the selected incident's page, select Retain Incident.

To disable retention for an incident, select Undo Retain Incident from the Actions menu.

Bulk retain incidents

1. From the Incidents page, select the incidents to retain.
2. Click Retention → Retain.

To disable retention for a group of incidents, select the incidents in the Incidents page and click Retention → Undo Retain.

Search for retained incidents

To search for retained incidents in the Incidents search bar, use the retained field, with T (True) or F (False). You can also add the Retain Incident field to the Incidents table to easily view which incidents are retained.