Archive Inactive Assets
Hide decommissioned machines from the Assets view without deleting anything. Their files stay searchable and keep matching rules written years later.
Archiving takes an asset out of the default Assets view. It deletes nothing.
That distinction is the whole point, and it is worth being precise about because "archive" sounds like disposal. Every file the machine reported is still held, still searchable, still counted in prevalence, and still matched by YARA rules written long after the machine was retired. What changes is that the asset stops cluttering a list you read every week.
This is the same property that makes assets useful in the first place: the record outlives the machine. A laptop wiped and reissued eight months ago is still the asset that reported those files, and a report published this morning can still tell you it held one.
When should I archive something?
When the machine is not coming back, or you have stopped expecting it to check in:
- It has been decommissioned, reimaged, or replaced.
- It has stopped checking in and nobody expects it to resume.
- It is making the Assets view harder to read, which matters more than it sounds when you are using that view to find coverage gaps.
Do not archive a machine that has merely gone quiet. A forwarder that stopped reporting is a coverage problem to investigate, not a row to hide, and archiving it removes exactly the signal you would use to notice. Work through Forwarder Troubleshooting first. Archive when you know why it went quiet, not because it did.
How do I archive an asset?
Administrators only.
- Open the Assets tab.
- Find the assets you want. The Last seen filter is the fast way to surface inactive ones.
- Select them, then right-click.
- Choose Archive Assets.
They leave the default view immediately.
What actually changes?
| Removed from the Assets tab | Yes |
| Data deleted | No |
| Files still searchable | Yes |
| Still matched by new YARA rules | Yes |
| History and detections preserved | Yes |
So an archived asset keeps contributing to every question about the past, and stops appearing in every question about the present. That is usually exactly what you want from a machine that no longer exists.
What should I read next?
- Assets, for why the record is worth keeping after the machine is gone.
- Forwarder Troubleshooting, for a machine that went quiet unexpectedly.
- Sleep and Wake Forwarders, for pausing a machine that is coming back.
Updated 20 days ago