Remove Observables from EDL

  • Release version: Australia
  • Updated March 12, 2026
  • 1 minute to read

    • Remove observables from an External Dynamic List (EDL) to stop blocking or monitoring specific observables. Use this when observables are no longer relevant or incorrectly categorized.

    Before you begin

    Role required: sn_sec_tisc.analyst

    Procedure

    1. Navigate to Workspaces > Threat Intelligence Security Center.
    2. Select the Threat Analyst Workbench.
    3. Navigate to Observables > All Observables.
    4. Open any observable record.
    5. Select Remove from EDL button to remove the entries from the list.
      The Remove from EDL modal opens. Complete the removal process. You can add observables back to the list later. For more information, see Add Observables to EDLs.