topic Re: How to Delete War Room Entries or Clear War Room in Cortex XSOAR Discussions

How to Delete War Room Entries or Clear War Room

michaelsysec242 — Mon, 17 Feb 2025 08:43:36 GMT

Hello LiveComm,

is there a way to remove an entry from an XSOAR incident ? This is needed for general entries and not just files as files can be deleted with Core API. An example of this can be a comment by an analyst or any textual entry. Perhaps the war room can be fully cleared ? I see that every entry has a URL but this does not work with the Delete Commands.

Many thanks,

MSys

Re: How to Delete War Room Entries or Clear War Room

gchawla — Tue, 18 Feb 2025 17:02:32 GMT

Hi @michaelsysec242 As long as you are the owner/creator of an entry in the war room, you can edit and delete it.
If you edit an entry, the "History" button becomes available as well. For example, in the screenshot I edited my command entry to add "XYZ" to it and you can see the History button is available now.

Rest you can delete with the API.

Hope this helps.

Re: How to Delete War Room Entries or Clear War Room

michaelsysec242 — Wed, 19 Feb 2025 08:33:32 GMT

Thanks for your reply, I want to do this programmatically and the API docs do not provide this feature. Please let me know if you found a different solution.