Expire TDL Content
You can expire TDL content that is no longer relevant. Expiring TDL content does not permanently remove the TDL content from the repository but the status of the content is marked as Expired. Analysts can view expired content in the TDL repository but cannot attach it to alerts. For more information about attaching TDL content to alerts, see Attach TDL Content.
Before you Start
Ensure you have View and Expire permissions for Threat Defender Library in Roles & Permissions.
Steps
To expire TDL content, follow these steps:
Click Threat Defender Library on the sidebar.
Hover over the content and click Expire. Alternatively, you can click the content to view the content details. Click the vertical ellipses in the upper-right corner, and select Expire.
Note
As an analyst, you can expire content from the Analyst Repo and Member Repo which have the Shared as Preview and Published statuses. You can also expire created by you. However, you cannot expire content in Declined by Analyst and Under Analyst Review statuses.