An alert was deleted...it no longer shows up under Content Management, but it still shows up under the Incident Review dropdown. Is there a way to remove it from the Incident Review dropdown?
Yes, this is helpful....thanks! So not possible through the web interface, but might be a way through the CLI.
If this is useful and answer suffice, please "Accept" the answer 😀 .
I guess, its not directly possible.
Because in Incident Review "Correlation Search" select option takes use-cases lists which already generated notable (not on enabled use-cases)
Because notable got generated from a "use-case/correlation search", before you deleted the use-case. This is mainly build for audit purpose.
Hope this helps.