Deleting Actions

Security Requirements and Controls

Deleting an action removes the action and configuration. An action that has been assigned to a working alert cannot be removed; the alerts must be edited to remove the actions and then the action can be deleted.


Before deleting, if you think you might need the action again, you can export the action to a YAML file. See Exporting an Action

To delete an action:

  1. Go to the Repository and Views page.

  2. Select a Repository or View.

  3. Click the Alerts tab on the top bar of the User Interface

  4. Select Actions from the menu on the left

  5. Locate the action that will be duplicated. Then click the ⋮ next to the action name. Choose Delete

  6. The Delete action dialog will be presented to confirm that the action should be deleted.

    Deleting an Action Dialog

    Figure 163. Deleting an Action Dialog

    • To delete, click the Delete action button

    • To cancel, click the Cancel

  7. If the action is configured or assigned to a scheduled search or alert, an alert will be presented to show that the action could not be deleted. The action should be removed for any configures searches and alerts before you delete the action.