topic Re: Can deleted events be restored? in Splunk SOAR

Can deleted events be restored?

CS_ — Mon, 21 Feb 2022 11:27:46 GMT

I read in another thread that events are not really "deleted" as such, but that they are simply marked in a way that removes them from the search - however that may be just relating to SPLUNK.

So if you have a need to restore a deleted event + it's associated containers, actions, logs, etc, is there a way to do that in SOAR/Phantom

Re: Can deleted events be restored?

phanTom — Mon, 21 Feb 2022 12:41:28 GMT

@CS_ it may be similar in that the database entry/entries may only be masked from the UI but you would need to go digging through postgres database to find all the relevant entries, if they still exist!

This is why the ability to delete is not allowed on any out of the box account (except admin) as it is not simple to recover from a deletion.

I would recommend a support call to verify this and for them to advise how, if at all, you might be able to retrieve the data.

If you externalise your data to Splunk you might be able to "stitch" the data back together but it wouldn't be simple.

Re: Can deleted events be restored?

CS_ — Mon, 21 Feb 2022 13:00:40 GMT

Hey @phanTom

Thanks for the response. Luckily there is no loss of important data, they were just test events we were sending from Splunk.

If there is no way to do it through the frontend, I'll mark it as a "cannot be done".

Best,

Chris