Hi everyone,

in my customer's Sentinel installation, there are events that we do not
need to store, however we do want to perform correlation on them.
This was possible in past versions of Sentinel (a filter on the DB
iirc) but I cannot find that option anymore.

Right now, I have tagged these events and created a retention policy of
1 day, max 2. However I wonder if it is possible to not store these
events at all (but keep the correlation possibilities)?