Incident response - Clearing the database
In some cases it becomes necessary to clear the incident response database. Some of the reasons for this is:
Poorly configured or “noisy” alerts that created a large influx of the same event
The database needs to be reset annually
Corruption
NOTE: For the example below, the namespace used is tenant1
The steps to perform this activity are:
Scale down incident response
CODEkubectl -n tenant1 scale sts tenant1-thehive --replicas=0
Enter into the database pod
CODEkubectl -n tenant1 exec -it tenant1-scylla-0 bash
Type cqlsh and Press [ENTER]
Type the line below and then Press [ENTER]
CODE'drop keyspace thehive;'
Type exit and Press [ENTER]
Press [CTRL]+[D]
Scale up incident response
CODEkubectl -n tenant1 scale sts tenant1-thehive --replicas=1