IBM Security QRadar

 View Only

Safely delete logsource groups

  • 1.  Safely delete logsource groups

    Posted Fri November 18, 2022 07:01 AM
    Hello all, 
    I am re-working the log source groups structure in our company. I did create lots of new log source groups, lots of those have same names like the old ones but are under new tree structure. I know some of the old ones are used in rules, so I will have to remove them and add the new ones into the rule and then delete the old ones. Unfortunately I did not build the system from start, so I dont know what has dependencies where. I would like to ask for your opinions how to proceed in this matter so I can safely identify all the dependencies and not cause any issues in our production environment.  I know some ppl here have years of experience with such problems. Thank you for any advice!

    ------------------------------
    Tomas Tyser
    ------------------------------