topic Re: Free space in XSOAR in Cortex XSOAR Discussions

Free space in XSOAR

Josep — Thu, 14 Sep 2023 10:42:10 GMT

Hello,

We're feeding XSOAR with a lot of incidents. To avoid this, we created a job which deletes incidents each week. However, due to the amount of them, the command "SearchIncidentsV2" fails, it's no capable to search them. How can we free space by deleting incidents in a massive way?

Re: Free space in XSOAR

MBeauchamp2 — Wed, 20 Sep 2023 14:48:21 GMT

In this case you'll want to archive the older database partitions using this method:

https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.12/Cortex-XSOAR-Administrator-Guide/Free-up-Disk-Space-with-Data-Archiving

It's an all or nothing approach however, as the partitions contain all Incidents for the given month.

Re: Free space in XSOAR

Josep — Thu, 21 Sep 2023 06:16:51 GMT

Thanks for your answer,

The main problem if we try to archive is that we can't apply retention policies for each type of incidents. Some incidents are kept inside XSOAR for 2 years and others are not needed anymore in 1 week. How can we apply this selective archiving?

Re: Free space in XSOAR

chrking — Tue, 10 Oct 2023 05:33:21 GMT

It's not possible to selectively archive like this. Archived data can be restored later if needed so that's probably the approach I'd take for data that needs a longer retention. Exporting (only) the incidents with longer retention requirements is also an option.

Please also note that, at least for XSOAR 6 with Bolt, deleting an incident will not free space in the database associated with that incident. Additionally, files attached to incidents can be deleted separately with standard file system commands: https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.8/Cortex-XSOAR-Administrator-Guide/Archive-Artifacts-and-Attachments