How to perform a data reset on an appliance in RSA Security Analytics 10.x and NetWitness Platform 11.x

Issue

How to perform a data reset on an appliance in RSA Security Analytics 10.x or NetWitness Logs & Network 11.x.

Resolution

In order to perform a data reset on a core appliance in RSA Security Analytics 10.x or NetWitness Logs & Network 11.x, follow the steps below.

1. In the Security Analytics or NetWitness UI, navigate to Administration -> Services (SA 10.x) or ADMIN -> Services (NW 11.x).
2. Click on the icon in the Actions column for the service and select View -> Explore.
3. In the directory tree, right-click on the folder with the appliance type (i.e. broker, concentrator, decoder, etc.) and click on Properties.
4. In the lower-right pane that appears, select reset from the drop-down menu.
5. In the parameters field, type data=1 and click the Send button.
6. Copy "verify=xxx" from the Response Output, add it to Parameters (e.g. data=1 verify=12345) and click the Send button.
   
   

Performing these steps will clear the ingested data on the appliance, but will maintain its configuration and logs.

If you are unsure of any of the steps above or experience any issues, contact RSA Support and quote this article ID for further assistance.

Notes

For steps on performing a data reset on an appliance in RSA Security Analytics 10.3.x and below, refer to the knowledgebase article a67928.

Internal Comments

UserName:shurtj
9/22/2014 4:07:53 PM - Created Article
Created article as a supplement to KB article a67928.

UserName:moonj1
10/3/2014 5:15:11 AM - Modified Article
Added Step 6 to add "verify=xxx" and some bold characters.

James Moon -- 28 Aug 2019
Updated the article to support Netwitness 11.x as well.

Product Details

RSA Product Set: Security Analytics, NetWitness Logs & Network
RSA Product/Service Type: Core Appliance
RSA Version/Condition: 10.x, 11.x
Platform: CentOS
O/S Version: EL6, EL7

Approval Reviewer Queue

RSA NetWitness Suite Approval Queue