RSA NetWitness 11.x Unable to delete event sources

Issue

Unable to delete event sources on the RSA Security Analytics UI, event sources re-appear after refreshing the page. 

Tasks

Unable to delete Event Sources from NW UI, under Admin > Event Sources > Manage

Resolution

1. SSH to the Admin Server and backup  the ESM Collection
   mongoexport --db esm --collection eventsources --out /root/appliance_update.json -u deploy_admin -p [password] --authenticationDatabase admin
2. Login to Mongo DB and verify the event source that needs to be deleted.
   mongo -u deploy_admin -p <password>
   use esm
   db.eventsources.find({"_id" : "[Event Source IP Address]-[Event Source Type]"}).pretty()
   
   Example:
   db.eventsources.find({"_id" : "10.1.1.1-windows"}).pretty()
   
3. After verifying, delete the event source.
   db.eventsources.remove({"_id" : "[Event Source IP Address]-[Event Source Type]"})
   
   Example:
   db.eventsources.remove({"_id" : "10.1.1.1-windows"})
   
4. Refresh the Event Source page to confirm if the event source is deleted.

 

Product Details

Approval Reviewer Queue

RSA NetWitness Suite Approval Queue