Cleaning the SIM data model

Cleaning the SIM data model ensures that offenses are based on the most current rules, discovered servers, and network hierarchy. When the tuning process is complete, clean the SIM data model to ensure that IBM® QRadar® displays only recent offenses.

About this task

When you clean the SIM data model, all existing offenses are closed. Cleaning the SIM data model does not affect existing events and flows.

False positive offenses might occur before you complete the tuning tasks. Clean the SIM data model to ensure that each host on the network creates new offenses based on the current configuration.

The SIM data model can be cleaned by both of the following methods:
Soft Clean
Closes all offenses, but does not remove them from the system.
Hard Clean
Closes all offenses, and completely erases them from the system.

Don't do a Hard Clean of your SIM Model unless SupportQRadar directs you to.

After a hard clean or a soft clean, the console web server restarts.


  1. On the navigation menu ( Navigation menu icon ), click Admin.
  2. From the Admin toolbar, click Advanced > Clean SIM Model.
  3. Click Soft Clean.
  4. Select the Are you sure you want to reset the data model? check box.
  5. Click Proceed.

    Depending on the volume of data in your system, this process might take several minutes.

  6. When the SIM reset process is complete, refresh your browser.

    If you attempt to go to other areas of the console during the SIM reset process, an error message is displayed.