Cleaning the SIM data model
Cleaning the SIM data model ensures that offenses are based on the most current rules, discovered servers, and network hierarchy. When the tuning process is complete, clean the SIM data model to ensure that IBM® QRadar® displays only recent offenses.
About this task
When you clean the SIM data model, all existing offenses are closed. Cleaning the SIM data model does not affect existing events and flows.
False positive offenses might occur before you complete the tuning tasks. Clean the SIM data model to ensure that each host on the network creates new offenses based on the current configuration.
The SIM data model can be cleaned by both of the following methods:
- Soft Clean
- Closes all offenses, but does not remove them from the system.
- Hard Clean
- Closes all offenses, and completely erases them from the system.
Note:
Don't do a Hard Clean of your SIM Model unless SupportQRadar directs you to.
After a hard clean or a soft clean, the console web server restarts.