# Threat Intel | Alien Vault

**URL:** <https://discuss.elastic.co/t/threat-intel-alien-vault/353205>\
**Category:** Elastic Security\
**Created:** [February 13, 2024, 7:51pm UTC](https://discuss.elastic.co/t/threat-intel-alien-vault/353205 "2024-02-13T19:51:33Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Jordan\_Santander](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jordan_santander/32/127174_2.png) [@Jordan\_Santander](https://discuss.elastic.co/u/Jordan_Santander)\
**Post date:** [February 13, 2024, 7:51pm UTC](https://discuss.elastic.co/t/threat-intel-alien-vault/353205/1 "2024-02-13T19:51:33Z")

</div>

Hello everobody

I need to know if the objects brought to elastic through the alien vault feed are deleted if I unsubscribe from the corresponding pulse. If not, do you know of a method to remove IoC?

Thanks

---

<div class="post-metadata">

**Author:** ![wsouza](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/wsouza/32/92547_2.png) [@wsouza](https://discuss.elastic.co/u/wsouza)\
**Post date:** [February 22, 2024, 3:30pm UTC](https://discuss.elastic.co/t/threat-intel-alien-vault/353205/2 "2024-02-22T15:30:55Z")

</div>

Hi, @Jordan_Santander!

As far as I know, Alien vault is free for ingesting IoCs, making it necessary to create access to your account via API in the integration settings. I use it here in my environment at no cost. Regarding the removal of IoC data that has already been stored, you can create an ILM policy to delete it, however, it is interesting to have this history for the correlation of Intel Threat rules.

---

<div class="post-metadata">

**Author:** ![Jordan\_Santander](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jordan_santander/32/127174_2.png) [@Jordan\_Santander](https://discuss.elastic.co/u/Jordan_Santander)\
**Post date:** [February 22, 2024, 3:45pm UTC](https://discuss.elastic.co/t/threat-intel-alien-vault/353205/3 "2024-02-22T15:45:47Z")

</div>

Hello Wagner

Thanks for your reply, we had to delete the objects due to a pulse that brought thousands of indicators that generated hundreds of unnecessary alerts. In addition to the ILM policy, I used the datastream deletion via API [Delete data stream API | Elasticsearch Guide [8.12] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/indices-delete-data-stream.html).

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 21, 2024, 3:45pm UTC](https://discuss.elastic.co/t/threat-intel-alien-vault/353205/4 "2024-03-21T15:45:59Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.