304 Sentinel 6.1 User Guidenovdocx (en) 7 January 2010(1) Delete Incidents By Query – You will be prompted to enter a custom SELECT query.For example:select inc_id from incidents where inc_id=500NOTE: The SELECT statement cannot include quotation marks.(2) Delete Incidents By Rule – You will be prompted to enter the name of the CorrelationRule(s) that created the Incident(s) For example:My Test Rule(3) Delete Incidents By Id – You will be prompted to enter the ID of a specific Incident.For example:101(q) Quit without action4e At the Incident Cleanup Confirmation prompt, type "start" to start the Incident cleanup(deletion) or "abort" to quit without performing any cleanup.4f The results of the Incident Cleanup will be written to the specified log file.NOTE: You should review the log file for any errors before continuing.5 If cleaning Identity, the following things happen:5a At the Identity Cleanup Confirmation prompt, type "start" to start the Identity cleanup or"abort" to quit without performing the Identity cleanup.5b The results of the Identity Cleanup will be written to the specified log file.NOTE: You should review the log file for any errors before continuing.5c In addition to deleting the Identity information from the database tables, the script willattempt to delete the Identity Account Map file (identityAccountMap.csv). So at thepromptPlease enter username with privileges to delete the identity map file=>enter the name of the user who has permission to delete the identity map file (located in%ESEC_HOME%/data/map_data directory).5d Enter the user’s password at the next prompt.NOTE: NOTE: If you have a distributed Sentinel install, you may need to manuallyconnect to the main Sentinel Server to delete the identityAccountMap.csv file.13.6 Updating Your License KeyIf your Sentinel license key has expired and Novell has issued you a new one, run the software keyprogram to update your license key.To update your license key (UNIX):1 Log into the machine where the DAS component is installed as the Sentinel Administratoroperating system user (default is esecadm).2 Go to $ESEC_HOME/bin.3 Specify the following command:
