Edit

Delete installed Microsoft Sentinel out-of-the-box content and solutions

  • Article
  • Applies to:
    Microsoft Sentinel in the Azure portal, Microsoft Sentinel in the Microsoft Defender portal.

If you installed a Microsoft Sentinel out-of-the-box solution, you can remove content items from the solution or delete the installed solution. If you later need to restore deleted content items, select Reinstall on the solution. Similarly, you can restore the solution by reinstalling the solution.

Important

Microsoft Sentinel is available as part of the public preview for the unified security operations platform in the Microsoft Defender portal. For more information, see Microsoft Sentinel in the Microsoft Defender portal.

Delete content items

Delete content items for an installed solution deployed by the content hub.

  1. For Microsoft Sentinel in the Azure portal, under Content management, select Content hub.
    For Microsoft Sentinel in the Defender portal, select Microsoft Sentinel > Content management > Content hub.

  2. Select an installed solution where the version is 2.0.0 or higher.

  3. On the solutions details page, select Manage.

  4. Select the content item or items you want to delete.

  5. Select Delete.

    Screenshot of solution with content items selected for deletion.

To restore deleted content items, select Reinstall on the solution.

Delete the solution

Delete a solution and the related content templates from the content hub or in the manage solution view. Active, cloned, saved, or custom items associated with a content template aren't deleted.

  1. In the content hub, select an installed solution.

  2. On the solutions details page, select Delete.

  3. Select Yes to delete the solution and the templates.

    Screenshot of the confirmation prompt to delete the solution.

To restore an out-of-the-box solution from the content hub, select the solution and Install.