Skip navigation
All Places > Products > RSA NetWitness Platform > RSA NetWitness Platform Online Documentation > Documents
Log in to create and rate content, and to follow, bookmark, and share content with other members.

ESM: Edit or Delete Event Source Groups

Document created by RSA Information Design and Development Employee on Sep 6, 2017Last modified by RSA Information Design and Development Employee on Apr 23, 2020
Version 18Show Document
  • View in full screen mode

You may occasionally need to remove an event source group. For example, if you close an office, and you had a group consisting of all the event sources in that office, you can remove the group, since none of those event sources will send information to NetWitness Platform.

Similarly, you may need to change some of the conditions that are used to populate the group.

Note: You cannot edit the event source group name. After you create a group, that name exists as long as the group itself exists.

Edit an Event Source Group

  1. Go to ADMIN > Event Sources.
  2. In the Manage panel, select an existing Event Source Group.
  3. Click edit icon.

    The Edit Event Group dialog is displayed.

  4. Modify any of the details, or add, edit or remove conditions as necessary.
  5. Click Save.

Delete an Event Source Group

Note the following:

  • You can delete any group except for the All group, which lists all configured event sources in the system.
  • If you delete a group, the associated policy for that group also gets deleted automatically.
  • If there are any event sources that belong only to the deleted group, they would no longer have a policy alarm associated with them. Remember that event sources can belong to multiple groups.
  • Deleting a group has no effect on baseline alarms.

To delete an event source group:

  1. Go to Admin > Event Sources.
  2. In the Manage panel, select an existing Event Source Group.
  3. Click delete icon.

    A confirmation dialog is displayed.

  4. Click Yes to delete the group.

You are here
Table of Contents > Manage Event Source Groups > Edit or Delete Event Source Groups