Retain incidents - Retain an incident according to the Retention Policy. - Administrator Guide - 8 - Cortex XSOAR - Cortex - Security Operations

To disable retention for an incident, select Undo Retain Incident from the Actions menu.

To disable retention for a group of incidents, select the incidents in the Incidents page and click Retention → Undo Retain.

To search for retained incidents in the Incidents search bar, use the retained field, with T (True) or F (False). You can also add the Retain Incident field to the Incidents table to easily view which incidents are retained.