Cisco
Login
Search
Software Secure Workload
Activity Configure

Configure and Monitor Forensic Events Forensic Configuration Forensic Rules Bulk Delete Forensic Rules

Last updated: Jun 09, 2025

Bulk Delete Forensic Rules

Before you begin

To delete forensic rules in bulk, identify the rules that are unused by agent configuration profiles.

Procedure

1

From the navigation pane, choose Defend > Forensic Rules.

  • Click the All tab to display all the rules, profiles and intents configured under Forensics Config.


     

    By default, the checkboxes for default rules that are used by profiles are disabled.

  • Click the Unused tab to view the rules that are not used by any profiles, and or unused for a certain duration of time.

  • From the dropdown list, select the time duration for rules that are not used by any profiles:

    • Anytime

    • Unused for a week

    • Unused for a month

    • Unused for 3 months

    • Unused for 6 months
2

Enable the Delete button (under the Action column) for the rules that you wish to delete.
3

Select the check boxes for the rules that you wish to delete.


 
By default, the Delete button is disabled.
4

Click the Delete button next to the Create Rule button. Review the list of rules that you want to delete.
5

Click Delete to confirm.


 
At a time, you can delete only those rules selected on a page.
Previous topic Default MITRE ATT&CK Rules Next topic Forensic profiles