Delete data source events from ELM

[LuisJavier]

Hi, 

I want to delete some events from the ELM of a certain data source and, if possible, from a certain data range.

I've been looking and the only thing close to what I want is this from 2014: https://community.mcafee.com/t5/Security-Information-and-Event/What-happens-with-events-when-you-del...

It says that when you delete a data source, the events in the ELM are no longer searchable. It's not quite I want but close, and since it's an old post, I ignore if it still working like that.

I also thought about changing the retention pool of the data source and make it shorter, to delete only old events, but I don't know if that would work and If it can be done in a single data source without affecting other data sources. 

Any ideas?

[McAfeeSIEM_Eric]

LuisJavierReport,

Either option you use will not actually delete the information, it will mark it as available space. This works similar to how windows deletes information. If you would like to suggest this as a feature for the ELM please submit the product idea:

https://community.mcafee.com/t5/Enterprise-Customer-Product/idb-p/business-ideas

If you need this information deleted from the ELM you could work through Professional Services to have this accomplished.

[Dimm]

Try to connect to the ELM via SFTP. I didn't test deletion but "Delete" button is actually available to click in WinSCP. You just have to find specific file with logs you want to delete, be careful to no delete something you (or compliance) need.