DLP: understanding incident and its associated evidence purge

[JKBH1]

Hello,

We are cleaning up old incidents and their related evidences to release more space in our DLP evidence share.

So, I created new tasks under DLP Manager to purge old and false positives incidents. So, it looks like these tasks are combined with the DLP Purge Operational Events and Incidents that runs every night.

I'm seeing this in the notes though: "Deletes events and incidents from the LIVE database tables. Evidence files are not deleted since they associated with the event or incidents in the HISTORY lists."

We need the evidence files to be removed so as to free up space. Do I need to create another DLP purge task pertaining to the history data (i.e. Data in-use/motion - History)? 

Please assist. Thank you.

[Corey-DLP · Accepted solution]

Hello and thank you for posting here!

In order for evidence files to be deleted, all incidents the evidence files are linked to must also be deleted. This includes incidents that are in the live tables (Incident List) as well as the history tables (Incident History). This would mean that a separate purge task would also need to be created for the Incident History list and the "DLP Purge History of Operational Events and Incidents" server task must be run. 

It should be noted that evidence files are initially moved to a folder named "PendingDelete" which resides in the Evidence Share. The evidence files will remain here for 30 calendar days; at which point they will be permanently deleted.