Archive an Indicator of Attack

Applies To: WatchGuard Advanced EPDR This topic applies to the WatchGuard Advanced EPDR endpoint security product., WatchGuard EPDR This topic applies to the WatchGuard EPDR endpoint security product., WatchGuard EDR This topic applies to the WatchGuard EDR endpoint security product.

If you have analyzed or resolved an Indicator of Attack, you can archive it from the Indicators of Attack list of the individual attack details page.

Your operator role determines what you can see and do in WatchGuard Cloud. Your role must have the Configure IOA permission to view or configure this feature. For more information, go to Manage WatchGuard Cloud Operators and Roles.

To archive an IOA, from the Indicators of Attack list:

1. Click the options menu in a row.
2. Select the Archive IOA.
   If you have already archived the IOA, this option is not available. You can select Mark IOA as Pending.

To archive an IOA, from the attack details page:

1. To open the details for an Indicator of Attack, in the Indicators of Attack list, click a row.

2. In the notification section of the page, next to the Detection Date, click Archive IOA.

Related Topics

Indicator of Attack Details

Mark an Indicator of Attack as Pending