After you tune your deployment, avoid receiving any additional false positive information
by resetting SIM to remove all offense, and source and destination IP addresses from the database
and the disk.
About this task
The SIM reset process can take several minutes, depending on the amount of data in your system.
If you attempt to move to other areas of the IBM®
QRadar® user interface during the
SIM reset process, an error message is displayed.
Procedure
-
On the
navigation menu (
), click
Admin.
-
From the Advanced menu, select
Clean SIM Model.
-
Read the information on the Reset SIM Data Model window.
-
Select one of the following options.
| Option |
Description |
|---|
| Soft Clean |
Closes all offenses in the database. If you select the Soft
Clean option, you can also select the Deactivate
all offenses check box. |
| Hard Clean |
Purges all current and historical SIM data from the database, including protected offenses,
source IP addresses, and destination IP addresses. |
-
If you want to continue, select the Are you
sure you want to reset the data model? check box.
-
Click Proceed.
-
When the SIM reset process is complete, click Close.
-
Refresh your web browser.