1. Log on to the ePO console.
2. Go to Menu, DLP Incident Manager, Incident Tasks.
3. Select Data in-use/motion from the drop-down list.
4. Select Purge Incidents under Task Type.
5. Click Actions and select New Rule from the drop-down list. The Purge Rule page appears.
6. In the Purge Rule page:
   1. Name: Enter a name for the purge rule.
   2. Description: Provide description for the rule.
   3. State: Set to Enabled.
   4. Click Next.
7. Set the Rule Criteria as required and Click Save.
8. Go to Menu, Server Tasks.
9. Run the DLP Purge Operational Events and Incidents task.
10. After the task is completed, go to Incident Manager, Incident Task.
11. Select Data in-use/motion – History from the drop-down list. In the Purging rules panel, click the purging rule. In this example, the purging rule is “Purge from history”.
12. Make sure that the state is set to Enabled. Click Next.
13. Set the rule criteria as required and click Save.
14. Now, go to Menu, Server Task.
15. Run the DLP Purge History of Operational Events and Incidents task.

Now, the evidence files associated with the incidents are moved to the pending delete folder.

By default, the file in the “Pending delete” folder is retained for 60 days. If the evidence files in the pending delete folder are not required and not used by any other incidents, you can delete the files manually. To delete, right-click the folders inside Pending delete and delete.