Remove Entry From Incident Review Search List

[woosh]

An alert was deleted...it no longer shows up under Content Management, but it still shows up under the Incident Review dropdown.  Is there a way to remove it from the Incident Review dropdown?

[woosh]

Yes, this is helpful....thanks!  So not possible through the web interface, but might be a way through the CLI.  

[General_Talos]

If this is useful and answer suffice, please "Accept"  the answer 😀 .

[General_Talos]

I guess, its not directly possible.

Because in Incident Review "Correlation Search" select option takes use-cases lists which already generated notable (not on enabled use-cases)

Because notable got generated from a "use-case/correlation search", before you deleted the use-case. This is mainly build for audit purpose.

Hope this helps.