Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

 
 

Deleting Rules

Delete user-created rules from QRadar that you no longer need. You can't delete system or override rules, or rules that have dependencies.

  1. On the Use Case Explorer page, expand the Origin rule attribute in the Rule attributes filter, select the User checkbox, and click Apply Filters.
    You cannot delete rules with a system or override origin, so filtering the list fine-tunes the results for you to work with. System rules are default rules. Override rules are customized default rules.
  2. Click the pencil icon in the report table to display checkboxes for each table row.
  3. Select the checkbox for each rule that you want to delete and click Delete.
  4. In the Delete rules window, review the status of each rule that you want to delete.
    Rules that have dependent rules are not deleted.
  5. Click Delete to see the status of the delete process, or Delete and close.
    If you click Delete and close, and a rule cannot be deleted because it has dependencies, the window remains open to display the rules that aren't deleted.
The rules are permanently deleted from QRadar. If you want to add them back in, you must re-create them.