NetWitness 'Malware Analysis database' hash values deletion

Issue

User wishes to delete all of the hash values that are added to the Malware Analysis database from CLI.

Resolution

To remove all hash values from the Malware Analysis database :

connect to the appliance via SSH as the root user
Stop the Malware Analysis service

 systemctl stop rsa-nw-malware-analytics-server

Run the following commands:

 #su postgres

 $psql spectrum

  #truncate hashvalue;
 

#\q

  $exit
 

Example:

  [root@MA ~]# 
  su postgres
  
  bash-4.2$ psql spectrum
could not change directory to "/root"
psql (9.2.24)
Type "help" for help.
spectrum=#

Pre-Count:

  spectrum=# select count(*) from hashvalue ;
  
count 
  
-------
  
56
  
(57 row)
  
spectrum=#

  spectrum=# 
  truncate hashvalue ;
 

Post-Count:

  spectrum=# select count(*) from hashvalue ;
  
count 
  
-------
  
0
  
(1 row)
  
spectrum=#

  spectrum=# 
  \q

  bash-4.2$ exit

Start Malware Analysis service

  systemctl start rsa-nw-malware-analytics-server
 

Product Details

NetWItness Product Set: NetWitness Platform
NetWItness Product/Service Type: Malware Analysis
NetWItness Version/Condition: 11.x, 12.x
Platform: CentOS 7 / Alma

Approval Reviewer Queue

Technical approval queue