Uninstall Insight Sensor

If you have Insight Sensor installed and no longer want to use it, perform the following steps to uninstall it.

To uninstall the Insight Sensor, you must first remove the Insight Sensor from the NetWitness Cloud Portal and then uninstall the Insight Sensor on the NetWitness Platform.

Step 1: Remove the Insight Sensor from the NetWitness Cloud Portal

  1. Log in to the NetWitness Cloud Portal.

  2. Go to admin icon Admin > Sensors > Sensor List.

  3. Select the Insight Sensor that you want to delete using the Host Name and click Remove Sensor.

    A confirmation pop-up is displayed.

  4. Click Remove Sensor.

Note

In case if the Device ID is displayed instead of Host Name. You can find the device ID in the Explore view on the NetWitness Platform user interface. For more information, see Locate the Device ID for a Specific Insight sensor.

Step 2: Uninstall the Insight Sensor on the NetWitness Platform

  1. Log in to the NetWitness Platform.

  2. Navigate to admin icon Admin > Services.

  3. In the Services list, select the NetWitness Insight service and click Admin icon > View > Explore.

    The Explore view for the NetWitness Insight service is displayed.

  4. On the Explore view, in the left panel, click cloud > right-click Properties, select stop from the drop-down, and click Send.

    View network behavior panel for assets
  5. Navigate to the Services list view, select the NetWitness Insight service and click Admin icon > Delete.

    A confirmation pop-up is displayed.

  6. Click Yes.

  7. SSH to the Packet Decoder host on which the NetWitness Insight service is installed.

  8. Run the following command to stop the Insight service:

    systemctl stop nwcloud
    
  9. Run the following command to get the Insight RPM package name:

    rpm -qa | grep rsa-nw-cloud
    

    The rpm package name will be displayed. For example, rpm -e rsa-nw-cloud-12.3.0.0-12746.5.b9d72db10.el7.x86_64

  10. Run the following command to uninstall:

    rpm -e <rpm package name>
    

    Replace <rpm package name> with the actual rpm package name.

    For example, rpm -e rsa-nw-cloud-12.3.0.0-12746.5.b9d72db10.el7.x86_64

  11. Run the following command to remove the cloud config file:

    rm -f /etc/netwitness/ng/cloud-aws.json
    

See also