Delete of Domains in SAS Visual Investigator 10.6

[chaudharydeepak]

Hi team,

I'm working SAS Visual Investigator 10.6. I want to know how I can delete domains from the SAS Visual Investigator.

Thanks.

[_austin_ · Accepted solution]

Hello,

Although the UI doesn't currently allow you to delete a domain, you can delete it from a REST call. You will have to delete any alerts associated with that domain first. The curl statement for the delete is shown below.

exec curl -I -X DELETE "http://$HOST:$PORT/svi-alert/domains/$DOMAIN_ID" \
  --header "Content-Type:application/json" \
  --header "Authorization: Bearer $TOKEN"
 

[chaudharydeepak]

Hello ,

It works thanks a lot.

[shravanisreeyan]

Hi, can please tell me Why do we use domain window in SAS Visual investigator?what is the use?

[_austin_]

Are you asking "what are alert domains good for"?

If that is the question, I would explain it this way. Visual Investigator is meant to be an enterprise-level solution. So it may be used by multiple groups in a company for different reasons. For example, a domain can be used to represent a business unit, such as anti-money laundering or fraud. One of the principles of the alert framework is that we pull together all the suspicious activity for an "actionable entity" (the entity you need to investigate) into a single alert. But in a big system, different businesses could be investigating the same entity for different reasons. You probably don't want the fraud indicators triaged together with the money laundering activity or the insider threat activity. Each of those "alerting domains" are worked by different people, showing different information and behaving differently. For this reason, tagging your alerting event data by alert domain separates the alerts, guaranteeing that information from one source can be worked independently from information about another source. 

[shravanisreeyan]

Why do we create bridge table while creating relationships between entities ??On what basis we are creating?