RSA NetWitness 11.x Unable to delete event sources

[#1]

Article Number

000039808

Applies To

RSA Product Set: NetWitness Platform, NetWitness Platform
RSA Product/Service Type: Netwitness UI, ESA
RSA Version/Condition: 11.x
Platform: CentOS 7

Issue

Unable to delete event sources on the RSA Security Analytics UI, event sources re-appear after refreshing the page. 
 

Task

Unable to delete Event Sources from NW UI, under Admin > Event Sources > Manage

Image description

Resolution

1. SSH to the Admin Server and backup  the ESM Collection

   
   mongoexport --db esm --collection eventsources --out /root/appliance_update.json -u deploy_admin -p [password] --authenticationDatabase admin

2. Login to Mongo DB and verify the event source that needs to be deleted.

   
   mongo -u deploy_admin -p <password>
   use esm
   db.eventsources.find({"_id" : "[Event Source IP Address]-[Event Source Type]"}).pretty()
   
   Example:
   db.eventsources.find({"_id" : "10.1.1.1-windows"}).pretty()
   

3. After verifying, delete the event source.

   
   db.eventsources.remove({"_id" : "[Event Source IP Address]-[Event Source Type]"})
   
   Example:
   db.eventsources.remove({"_id" : "10.1.1.1-windows"})
   

4. Refresh the Event Source page to confirm if the event source is deleted.