Contents

Disable rules

Disable all Intelligence Center rules:

• Entity rules

• Observable rules

• Enrichment rules

• Discovery rules

To disable rules:

1. Go to Data configuration ( ) > Rules.

2. For each of the rule types (Entity, Observable, Enrichment, Discovery), select its corresponding tab to open a list of those rules.

3. Select the checkbox to the left of the Rule name column to select all visible rules.

   If you have more items than arevisible on the screen, you must either:

   • Increase the number of visible items per page and then select them.

   • Select Next page (>) and then select the newly selected items to add them to the list of currently selected items.

4. Select More ( ) > Disable from the list’s top-right corner to disable all selected rules.

Back up your data

Before proceeding to upgrade the platform or any of its third-party components, always back up your data.

Stop the Intelligence Center

Stop all backend services:

Clear Celery queues

1. Use the redis-cli command to check that Celery queues are empty:

   # Start redis-cli in interactive mode

   redis-cli

    

   # Run these commands in the redis-cli shell

   llen enrichers

   llen integrations

   llen priority_enrichers

   llen priority_providers

   llen priority_utilities

   llen providers

   llen reindexing

   llen utilities

2. If any of the queues are not empty, run the following commands to delete that queue:

   # Launch redis-cli

   $ redis-cli

    

   # Delete the entity ingestion queue

   $ > del "queue:ingestion:inbound"

    

   # Delete the graph ingestion queue

   $ > del "queue:graph:inbound"

    

   # Delete the search indexing queue

   $ > del "queue:search:inbound"

3. Stop the remaining Celery workers:

   systemctl stop eclecticiq-platform-backend-worker*.service

Clean up PID files

Check that there are no leftover PID files

1. Check for running IC processes:

   ps auxf | grep beat

2. Run kill to stop any remaining IC processes.

3. Manually remove any leftover PID files with the rm command.

   Usually, PID files are stored in /var/run.

Review configuration files

Elasticsearch

See Prepare upgrading to Elasticsearch 7 RHEL.

About databases and network bindings

On a single machine installation, network interface bindings for services are set to 127.0.0.1 by default, except for PostgreSQL which has a different configuration.

Instructions may have asked you to change this to a more permissive binding in multi-machine installations, or you may be using an older installation where defaults were set to 0.0.0.0.

The table below shows a list of configuration files where network interface bindings are set for each service.

You may want to change these bindings to suit your environment.