Caution: Prior to deleting cases, decide if you want to preserve them after deletion. If so, add this property (or ask an administrator to add it) in the server.properties file before deleting any cases:
case.archive_ondelete.enabled=true
The archived deleted cases are stored as read-only snapshots for historical purposes in the Manager’s archive/cases directory. The filename format of the archived case is
YYYY-MM-DD <deleted case name>.xml
For important details on changing properties files, refer to the topic, “Managing and Changing Properties File Settings” under the “Configuration” section of the ESM Administrator’s Guide.
There are two conditions where you cannot delete a case (right-click option to delete the case is disabled):
The case is locked.
You belong to a user group that does not have permission to delete cases. This permission, /All Permissions/ArcSight System/Case Operations/Case Delete, is granted through a user group’s ACL setting.
To delete a case:
In the Cases resources tree, unlock the case you want to delete, if necessary.
Right-click a case and select Delete Case.
Click Yes.
Note: If this case is linked to another, the linked case is also deleted. For related information on linked cases, see Moving or Copying a Case to a Group.