Old alerts and source alerts may be of limited value to your organization, and they can reduce the performance of your system and your system analysts.
By default, the Endpoint Security (HX) software automatically ages (removes) all alerts and source alerts that originate from Trellix appliances after their defined aging periods have passed.
You can change these aging periods. In addition, you can manually delete alerts and source alerts at any time.
Note
When indicator rules are deleted—whether automatically or manually—the Endpoint Security (HX) software also automatically deletes any associated alerts. The software does not delete any acquisitions associated with the deleted indicator rules.