Bulk delete Sentinel Threat Intelligence

Question

I used Workspace Purge Rest API to bulk delete Sentinel threat intelligence. I used the api to remove intelligence from 'ThreatIntelligenceIndicator' table on sentinel but this did not end up deleting them from Sentinel threat intelligence (under Threat management). Removing threat intel from the 'ThreatIntelligenceIndicator' table should reflect on Sentinel Threat Intelligence but I don't understand why it is not reflecting.

How can i resolve this issue?

Answer 1

I am not sure of the specific cause, but this is not a common practice, though technically feasible. I suspect this will clear up in 12-24 hours. You may need to open a support case if this runs longer.

It may help to consider how this feature functions. The TI view only displays the most recent, unique, active records from the table. Each IOC is given and ID. Any updates are represented as a new record. For example, when a record expires, a new record is written with an inactive flag for the IOC. I assume what you see in the portal is not a direct query. Likely a hidden sub-table that is updated periodically. The purge may have caused an unexpected interruption to this process.