Protecting offenses

You might have offenses that you want to retain regardless of the retention period. In the QRadar Analyst Workflow, you can protect offenses to prevent them from being removed from QRadar after the retention period has elapsed.

About this task

By default, offenses are retained for thirty days. For more information about customizing the offense retention period, see the IBM QRadar Administration Guide.

Procedure

  1. From the Offenses table, do one of the following:
    • Select any offenses you want to protect.
    • Click on a single offense listing to open the offense details.
  2. From the Actions list, select Protect.
    Tip: To remove the protection from the offense, select Unprotect from the Actions list.