Delete more quantity of alerts

[AntonioTeixeira]

Hello, I would like to eliminate all the alerts activated by a specific rule, I have around 100.000, when I try to eliminate only can delete 900 alerts of each time, any idea of how to eliminate a greater quantity?

[MarinosRoussos1]

Are these alerts from ESA or Reporting Engine?

[PedroQueiros]

From ESA, I think.

Is it possible to delete them directly from the MongoDB, using a client?

[MarinosRoussos1]

Yes, you can use esatool for that. Not for v11.x though, only up to 10.6.x.

000032358 - Event Stream Analysis troubleshooting script (ESATool) for the RSA NetWitness Platform 

[PedroQueiros]

Hm, ok, but we're using v11.x.

I'll try to delete using MongoDB directly.

Thank you for all your replies.

[MarinosRoussos1]

OK, in that case it will not work for 11.x as they are using a pure implementation of mongo as opposed to 10.6.x that used tokumx. 

If you are unsure or need help, you should raise it with Support.

[JoshRandall]

Since you're on 11, the command to access mongo and the appropriate DB and Collection to delete alerts directly will be a bit different than in 10.x.

You'll want to be SSH'd into the ESA when you run the commands, which will look like:

# mongo admin -u deploy_admin -p 'your_deploy_admin_password'
> use respond-server
> db.alert.remove({'originalHeaders.name' : 'the name of your alert' })

Or a bash one-liner:

echo -e 'use respond-server\ndb.alert.remove({"originalHeaders.name":"the name of your alert"})' | mongo admin -u deploy_admin -p your_deploy_admin_password

e.g.:

[RenatoGoncalves]

I have an alert that keeps firing even after the deletion in the UI tab of ESA rules...

I´ve use the commands above and eliminated the alert but it still keeps firing....what can i do to eliminate for good the alert?

[MarinosRoussos1]

There might be an issue with Synchronization of the rules. So ESA might think that one rule is enabled when its not, but it could be a result because that was not updated. You should raise a case for that.

[RenatoGoncalves]

Thanks Marinos,