000026635 - How to perform a data reset on an appliance in RSA Security Analytics 10.x and NetWitness Platform 11.x

Document created by RSA Customer Support Employee on Jun 14, 2016Last modified by RSA Customer Support on Sep 23, 2019
Version 4Show Document
  • View in full screen mode

Article Content

Article Number000026635
Applies ToRSA Product Set: Security Analytics, NetWitness Logs & Network
RSA Product/Service Type: Core Appliance
RSA Version/Condition: 10.x, 11.x
Platform: CentOS
O/S Version: EL6, EL7
IssueHow to perform a data reset on an appliance in RSA Security Analytics 10.x or NetWitness Logs & Network 11.x.
 
Resolution

In order to perform a data reset on a core appliance in RSA Security Analytics 10.x or NetWitness Logs & Network 11.x, follow the steps below.



  1. In the Security Analytics or NetWitness UI, navigate to Administration -> Services (SA 10.x) or ADMIN -> Services (NW 11.x).
  2. Click on the icon in the Actions column for the service and select View -> Explore.
  3. In the directory tree, right-click on the folder with the appliance type (i.e. broker, concentrator, decoder, etc.) and click on Properties.
  4. In the lower-right pane that appears, select reset from the drop-down menu.
  5. In the parameters field, type data=1 and click the Send button.
  6. Copy "verify=xxx" from the Response Output, add it to Parameters (e.g. data=1 verify=12345) and click the Send button.


Performing these steps will clear the ingested data on the appliance, but will maintain its configuration and logs.


If you are unsure of any of the steps above or experience any issues, contact RSA Support and quote this article ID for further assistance.
NotesFor steps on performing a data reset on an appliance in RSA Security Analytics 10.3.x and below, refer to the knowledgebase article a67928.
Legacy Article IDa67929

Attachments

    Outcomes