Archive an Indicator of Attack

Applies To: WatchGuard Advanced EPDR This topic applies to the WatchGuard Advanced EPDR endpoint security product., WatchGuard EPDR This topic applies to the WatchGuard EPDR endpoint security product., WatchGuard EDR This topic applies to the WatchGuard EDR endpoint security product.

If you have analyzed or resolved an Indicator of Attack, you can archive it from the Indicators of Attack list of the individual attack details page.

To archive an IOA, from the Indicators of Attack list:

1. Click the options menu in a row.
2. Select the Archive IOA.
   If you have already archived the IOA, this option is not available. You can select Mark IOA as Pending.

To archive an IOA, from the attack details page:

1. To open the details for an Indicator of Attack, in the Indicators of Attack list, click a row.

2. In the notification section of the page, next to the Detection Date, click Archive IOA.

Related Topics

Indicator of Attack Details

Mark an Indicator of Attack as Pending