Skip to main content

Attack Surface InsightsAttack Surface Insights Guide

Delete Entities in Attack Surface Insights

Delete obsolete entities created due to parsing or enrichment issues.

You can only delete entities created in the past 30 days.

If you delete an entity and it reappears, this indicates that there's an ongoing parsing or enrichment issue. To resolve the issue, adjust your security content to ignore the events creating the obsolete entities.

You can delete a single entity or multiple entities at once.

Delete an Entity

  1. You must search for the entity you're deleting.

  2. Select an entity to delete:

    • Select the entity, then click Delete.

      The details for user entity Barbara Salazar with the Delete action highlighted in a red rectangle.

    • For an entity, click the More menu The more options menu; three vertical dark grey dots on an off-white background., then select Delete.

      The more menu open for an entity with the Delete option highlighted in a red rectangle.

  3. In Delete User, you must select the disclaimer, I understand this action cannot be undone, then click DELETE.

    Threat Center cases or alerts whose detections are grouped by the entity are still available, but when you try to view entity details in Threat Center, you receive an error.

Delete Multiple Entities

  1. You must search for the entities you're deleting.

  2. Select the entities you're deleting:

    • To select all entities in the list, click the checkbox in the header row.

      The checkbox in the header row selected.

    • To select all existing entities matching your search query, click the checkbox in the header row, then click Select all <#> matching entities in the system.

      The checkbox in the header row selected with the Select all 36551 matching entities in the system action highlighted in a red rectangle.

    • To select specific entities, click the checkbox for each entity.

      The checkbox for three entities selected.

  3. Click Delete.

    The Delete action highlighted in a red rectangle.

  4. In Delete User, you must select the disclaimer, I understand this action cannot be undone, then click DELETE.

    Threat Center cases or alerts whose detections are grouped by the entities are still available, but when you view entity details in Threat Center, you receive an error.