Old indicator rules and conditions may be of limited value to your organization, and they can reduce the performance of your system and your system analysts.
By default, the Endpoint Security (HX) software automatically ages (removes) indicator rules after their defined aging periods have passed. Conditions are not removed from the database. Instead, they are dissociated from their associated integration-generated indicator rules. Custom indicator rules are not affected by aging periods.
You can change these aging periods. In addition, you can manually delete indicator rules and conditions at any time.
Note
When indicator rules are deleted—whether automatically or manually—the Endpoint Security (HX) software also automatically deletes any associated alerts. The software does not delete any acquisitions associated with the deleted indicator rules.