Table of Contents
Advertisement
(1) Delete Incidents By Query – You will be prompted to enter a custom SELECT query.
For example:
select inc_id from incidents where inc_id=500
NOTE: The SELECT statement cannot include quotation marks.
(2) Delete Incidents By Rule – You will be prompted to enter the name of the Correlation
Rule(s) that created the Incident(s) For example:
My Test Rule
(3) Delete Incidents By Id – You will be prompted to enter the ID of a specific Incident.
For example:
101
(q) Quit without action
4e At the Incident Cleanup Confirmation prompt, type "start" to start the Incident cleanup
(deletion) or "abort" to quit without performing any cleanup.
4f The results of the Incident Cleanup will be written to the specified log file.
NOTE: You should review the log file for any errors before continuing.
5 If cleaning Identity, the following things happen:
5a At the Identity Cleanup Confirmation prompt, type "start" to start the Identity cleanup or
"abort" to quit without performing the Identity cleanup.
5b The results of the Identity Cleanup will be written to the specified log file.
NOTE: You should review the log file for any errors before continuing.
5c In addition to deleting the Identity information from the database tables, the script will
attempt to delete the Identity Account Map file (identityAccountMap.csv). So at the
prompt
Please enter username with privileges to delete the identity map file
=>
enter the name of the user who has permission to delete the identity map file (located in
%ESEC_HOME%/data/map_data directory).
5d Enter the user's password at the next prompt.
NOTE: NOTE: If you have a distributed Sentinel install, you may need to manually
connect to the main Sentinel Server to delete the identityAccountMap.csv file.
13.6 Updating Your License Key
If your Sentinel license key has expired and Novell has issued you a new one, run the software key
program to update your license key.
To update your license key (UNIX):
1 Log into the machine where the DAS component is installed as the Sentinel Administrator
operating system user (default is esecadm).
2 Go to $ESEC_HOME/bin.
3 Specify the following command:
304 Sentinel 6.1 User Guide
Advertisement
Table of Contents
