Archive an Indicator of Attack

Applies To: WatchGuard EPDR, WatchGuard EDR

If you have analyzed or resolved an Indicator of Attack, you can archive it from the Indicators of Attack list of the individual attack details page.

To archive an IOA, from the Indicators of Attack list:

  1. Click the options menu in a row.
  2. Select the Archive IOA.
    If you have already archived the IOA, this option is not available. You can select Mark IOA as Pending.

To archive an IOA, from the attack details page:

  1. To open the details for an Indicator of Attack, in the Indicators of Attack list, click a row.

  1. In the notification section of the page, next to the Detection Date, click Archive IOA.

See Also

Indicator of Attack Details

Mark an Indicator of Attack as Pending