34.3 Restoring Dashboards After Restoring Data from a Different Sentinel Server

When you restore data from a different Sentinel server, the following dashboards are not displayed: Alerts, Threat Hunting, and User Activities. To display these dashboards, you must configure your Sentinel server.

To restore dashboards:

  1. Login to the Sentinel server where you want to restore data as a root user.

    Configure the /opt/novell/sentinel/3rdparty/elasticsearch/config/elasticsearch.yml file.

    Set the network.host to <IP address of the Sentinel server>.

  2. Restart the Sentinel Server.

  3. Delete the security.events.normalized_* index index pattern from Sentinel:

    1. Login to Sentinel.

    2. Open an affected dashboard.

    3. Click Management > Index Patterns.

    4. Delete security.events.normalized_*.

    5. Click Remove index pattern.

  4. Run the following command to delete the security.events.normalized_* index index from Elasticsearch:

    curl -X DELETE {ES_IP}:9200/security.events.normalized_*

  5. Re-create the index pattern:

    1. Go to cd opt/novell/sentinel/bin.

    2. Run the following command to apply mapping template on events index on the Elasticsearch:

      ./elasticsearch_index_template.sh {ES_IP} 9200 security.events.normalized_* <Number of Shards> <Number of Replicas>

    3. Run the following command to re-create the index pattern:

      ./create_kibana_index_pattern.sh {ES_IP:9200} security.events.normalized_*