How to delete an entitlement from an appliance in RSA Security Analytics 10.5

Issue

You may find that you need to delete an allocated entitlement from an appliance.

In my case, this was because 2 appliances have somehow used 1 entitlement as per the bellow screenshot.

As you will notice, there is no way to delete licenses from an appliance on 10.5 as the license section has been removed from REST API. The reset button in the UI does not do anything either.

Resolution

1. First get the Service ID (CID), you can do this from mongodb but it is safer from the UI to avoid confusion when there are many appliances.

Select the service in question and go to System tab. Under License information you will find the Service ID.

From mongodb, the command bellow will list ALL available licenses, including Metered, Service and OOTB. this can be done

 mongo sa
 
db.entitlement.find()

2. Then once you have the ServiceID, for example 561cd383f280f20154b944fe, SSH to SA appliance.

 mongo sa
 
db.entitlement.remove({ _id: ObjectId("561cd383f280f20154b944fe")})
 
exit
 
stop jettysrv && start jettysrv

Notes

Use with caution and keep this article internal.

Product Details

RSA Product Set: Security Analytics
RSA Product/Service Type: Security Analytics Server, Security Analytics UI
RSA Version/Condition: 10.5.0.0, 10.5.0.1, 10.5.0.2
Platform: CentOS
O/S Version: EL6

Approval Reviewer Queue

Technical approval queue