Deleting Data

ThreatExchange currently supports deletion for ThreatDescriptor objects and relationships between ThreatIndicator objects.

Deletion in the UI is not yet supported: please see here for details.

To delete a ThreatDescriptor using the API:


To delete a relationship between ThreatIndicators using the API:


We do not support deletes for Tags or MalwareAnalysis objects. If you wish to indicate data is no longer valid, set the expired_on field for automatic soft-deletes and the status field to NON_MALICIOUS for handling false positive cases.