35.3 Restoring Dashboards After Restoring Data from a Different Sentinel Server

When you restore data from a different Sentinel server, the following dashboards are not displayed: Alerts, Threat Hunting, and User Activities. To display these dashboards, you must configure your Sentinel server.

To restore dashboards:

  1. Ensure that the time and timezone are same in both the source machine from where you take the backup and the destination machine where you restore the data.

  2. Login to the Sentinel server where you want to restore data as a root user.

    Configure the /opt/novell/sentinel/3rdparty/elasticsearch/config/elasticsearch.yml file.

    Set the network.host to <IP address of the Sentinel server>.

  3. Restart the Sentinel Server.

  4. Delete the security.events.normalized_* index index pattern from Sentinel:

    1. Login to Sentinel.

    2. Open an affected dashboard.

    3. Click Management > Index Patterns.

    4. Delete security.events.normalized_*.

    5. Click Remove index pattern.

  5. Run the following command to delete the security.events.normalized_* index index from Elasticsearch:

    curl -X DELETE {ES_IP}:9200/security.events.normalized_*

  6. Re-create the index pattern:

    1. Go to cd opt/novell/sentinel/bin.

    2. Run the following command to apply mapping template on events index on the Elasticsearch:

      ./elasticsearch_index_template.sh {ES_IP} 9200 security.events.normalized_* <Number of Shards> <Number of Replicas>

    3. Run the following command to re-create the index pattern:

      ./create_kibana_index_pattern.sh {ES_IP:9200} security.events.normalized_*