000035377 - How To Change the Incident Management Database Account Password for RSA NetWitness

Document created by RSA Customer Support Employee on Aug 18, 2017
Version 1Show Document
  • View in full screen mode

Article Content

Article Number000035377
Applies ToRSA Product Set: Netwitness
RSA Product/Service Type: Incident Management (UI Server)
RSA Version/Condition: 10.4.x, 10.5.x, 10.6.x
Platform: CentOS
Platform (Other): MongoDB
O/S Version: EL6
IssueHow to change the IM DB Account Password?
ResolutionThe following steps will guide the user through the process for changing the Incident Management Database Account Password
1) Log onto the ESA Server
Using your preferred SSH client, SSH to the ESA Server and logon as root
2) Log onto MongoDB as the admin user
mongo admin -u admin -p {current_password} --authenticationDatabase admin
3) Execute the command to change the IM account password
User-added image
4) Change the IM account password in the UI
    a. Launch the UI for your SA instance and logon as admin
    b. Follow this path to access the Explore page for IM
        Administration > Services > {IM Service} > View > Explore
    c. Expand the tree in the left pane to access the proper location to change the IM password
        Incident Management > Service > configuration > database
    d. Change the value for Password to the password created in Step 3.
User-added image
5) Restart the IM Service
This permits the IM Service to accept the password change and force the session to start using the new password as assigned in the UI
Follow this path to restart the IM Service
Administration > Services > {IM Service} > Restart
6) To validate the new password entered in the UI matches the password in the database, view the Alerts page for Incidents: Incidents > Alerts
If content is viewable here, as expected, then the password change was successful