Having problems with your account or logging in?
A lot of changes are happening in the community right now. Some may affect you. READ MORE HERE

Feature Request: Automatic Case Delete

Feature Request: Automatic Case Delete

Hi all,

We are using external system to manage security incidents that registered at ESM by Rule firings.

As one of rule actions we set up case creation. Then with Case Search Group feature we export cases to external system, and do no more operations with cases at ESM side. So in that situation we have a lot of opened Cases in ESM resources.

Now we have to delete cases from console manualy. It uncomfortable to delet a lot of cases whent it more than 1000.

It will be nice to have ability to set Case TTL when case creating with rule action or something else to automate case deleting process.

Thanks,

Sergei

4 Comments
nmbabkin1 Absent Member.
Absent Member.

Hello, Sergey!

As it is not currently available in ESM itself, you can use this query to delete old cases:

select count(*) from arc_resource  where resource_type = 7 and created < 'yyyy-mm-dd hh:mm:ss';


and then:

delete from arc_resource  where resource_type = 7 and created < 'yyyy-mm-dd hh:mm:ss';

commit;



Please test (make a select) before deleting.

Phoenix_Reborn Absent Member.
Absent Member.

Hello, Nikolay!

Thanks for solution!

But it will be more attractive to not work with ArcSight database directly.

nmbabkin1 Absent Member.
Absent Member.

Sure, but this could be a temporary solution for you unless developers make it possible in ESM.

Phoenix_Reborn Absent Member.
Absent Member.

Оf course! We'll use it as temporary workaround! Thanks!

The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.