Deleting a case

If you have the required permission, you can delete cases. When you delete a case, it is permanently deleted from the system. Typically, you should close a case instead of deleting it.

The following actions occur when you delete one or more cases:
  • The case’s attachments, such as tasks and artifacts, are deleted.
  • The audit data for the case and child objects is deleted. However, the audit log contains a log of the deletion itself.
  • All references to the case are removed from the news feed and any existing system notifications.
  • If you delete multiple cases, the cases are deleted serially and in the background. Cases that are submitted for deletion remain visible until they are deleted.
  • If the case deletion fails, the error is logged in the cases-application-client-log-tailer file, but does not stop other cases from being deleted.
  • The case deletion includes deleting it from the database.
If you intend to delete many cases, you can take the following actions to minimize disruptions:
  • Disable any rules or playbooks that are configured to run when a case is deleted. If you do not have permission to access rules or playbooks, contact your system administrator.
  • In the Administrator Settings Notifications tab, disable any system or email notifications that are related to case deletions to prevent multiple notifications, including the default Incident Deleted notification. If you do not have access to the Notifications tab, contact your system administrator.
  • Disable the Incident Deleted notification in the Administrator Settings Notifications tab. If enabled, it sends an email for each case deleted. If you do not have access to the Notifications tab, contact your system administrator.

To delete a case from the incident page, click Actions then select Delete Case at the end of the menu.

To delete one or more case from the Cases page, select the cases, click Manage then select Delete.

You can verify that the case is deleted by checking the Cases page and verifying that the case is no longer shown. With permission, you can check the audit log for deleted cases.