Deleting invalid assets

After you fix the assets that contributed to the asset growth deviation, clean up your asset artifacts by using selective clean up or rebuilding the asset database.

About this task

Selective clean up
This method is for asset growth deviations of limited scope. Selectively removing the affected assets is the least invasive way to clean up asset artifacts, but if many assets were affected, it can also be the most tedious.
Rebuild the asset database
Rebuilding the asset database from scratch is the most efficient and precise method of deleting assets when asset growth deviations are pervasive.

This method passively regenerates assets in your database based on the new tuning that you configured to resolve the asset growth issues. With this approach, all scan results and residual asset data are lost, but the data can be reclaimed by rerunning a scan or re-importing scan results.

Procedure

  1. To selectively remove invalid artifacts in the asset database, perform these steps:
    1. On the Log Activity tab, run the Deviating Asset Growth: Asset Report event search.
      This search returns a report of assets that are affected by deviating asset growth and must be deleted.
    2. On the Assets tab, click Actions > Delete Asset
      There might be a delay before the asset no longer appears in IBM® QRadar®.
  2. To rebuild the asset database from scratch, perform these steps:
    1. Use SSH to log in to the QRadar Console as an administrator.
    2. Run the /opt/qradar/support/cleanAssetModel.sh script from the console command line and select Option 1 when prompted.

    Rebuilding the asset database restarts the asset reconciliation engine.

Results

Purging a blocklist removes all blocklist entries, including those entries that were added manually. Blocklist entries that were manually added must be added again.