Free space in XSOAR

[Josep]

Hello,

We're feeding XSOAR with a lot of incidents. To avoid this, we created a job which deletes incidents each week. However, due to the amount of them, the command "SearchIncidentsV2" fails, it's no capable to search them. How can we free space by deleting incidents in a massive way?

[MBeauchamp2]

In this case you'll want to archive the older database partitions using this method:

https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.12/Cortex-XSOAR-Administrator-Guide/Free-u...

It's an all or nothing approach however, as the partitions contain all Incidents for the given month. 

[Josep]

Thanks for your answer,

The main problem if we try to archive is that we can't apply retention policies for each type of incidents. Some incidents are kept inside XSOAR for 2 years and others are not needed anymore in 1 week. How can we apply this selective archiving?

[chrking]

It's not possible to selectively archive like this. Archived data can be restored later if needed so that's probably the approach I'd take for data that needs a longer retention. Exporting (only) the incidents with longer retention requirements is also an option.

Please also note that, at least for XSOAR 6 with Bolt, deleting an incident will not free space in the database associated with that incident. Additionally, files attached to incidents can be deleted separately with standard file system commands: https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.8/Cortex-XSOAR-Administrator-Guide/Archive...