Proofpoint | ObserveIT On-Premises Insider Threat Management

Deleting Rules

ObserveIT administrators can delete alert or prevent rules that are no longer relevant (they may have been created for demo or training purposes and are no longer required).

Only an ObserveIT administrator or user with Config Admin role permissions can delete an alert or prevention rule.

To delete a rule

  1. In the list of rules in the Alert & Prevent Rules page (ConfigurationAlertsAlert & Prevent Rules), select the rule(s) you want to delete. See Viewing Rules.

  2. Open the More Actions drop-down menu above the list of rules, and click the Delete hyperlink.

    A confirmation dialog box opens.

  3. Click OK to confirm the deletion(s).

    The rule(s) are deleted, and the alert and prevent rules list is refreshed.

version 7.13.1