Clear all alerts

[WPTechnician]

Hi:

I searched and found a solution for the older version of the software but nothing in the newer versions. Is there a way to just clear all alerts? I enabled some plays that are finding a boatload of false positives (>500K). Thanks!

[reyesj2]

I believe you're looking for sudo so-sensor-clean which removes all the log files for Zeek, Suricata, Strelka, and pcap files.
You'll also want to run so-elastic-clear which will wipe out the elastic indices so no more logs show up in kibana/soc

[WPTechnician]

Thanks!