To set the indicator rule aging interval using the CLI:
Enable the CLI configuration mode:
hostname > enable
hostname # configure terminal
Set the indicator rule aging interval:
hostname (config) # hx server detection aging indicator generated period <seconds>
where <seconds> is the number of seconds for the aging period for indicator rules. The default is 1209600 seconds (14 days). Valid values range from 60 seconds to 31536000 seconds (one year).
To reset this interval back to its default setting enter this command:
hostname (config) # no hx server detection aging indicator generated period
Endpoint Detection and Response with Forensics (EDRF) > Detect and handle potential threats with EDRF > Configure EDRF to detect potential threats > Threat detection using IOC rules > Threat detection using IOC rules in the Forensics workspace > Indicator rule aging > Specify indicator rule aging settings