Steps

 Version 51.0.11.0 and later

Stop the search provider service:

sudo systemctl stop restrict-search-provider

Get the state of the indices:

sudo curl -k -X GET "http://localhost:9200/incident/_settings?pretty"

Look for:

"read_only_allow_delete" : "true"

Example:

{
  "incident" : {
    "settings" : {
      "index" : {
        "blocks" : {
          "read_only_allow_delete" : "true"
        }
      }
    }
  }
}

Remove the restriction for all indices:

sudo curl -k -X PUT -H "Content-Type: application/json" \
http://localhost:9200/_all/_settings \
-d ' {"index.blocks.read_only_allow_delete": null} '

Verify the lock has been removed:

sudo curl -k -X GET "http://localhost:9200/incident/_settings?pretty"

The following should no longer be present:

"read_only_allow_delete" : "true"

Restart the services:

sudo systemctl restart resilient
sudo systemctl start restrict-search-provider

Versions before 51.0.11.0

Stop the Elasticsearch service:

sudo systemctl stop restrict-elastic

Get the state of the indices:

sudo curl -k -X GET "http://localhost:9200/incident/_settings?pretty"

Look for:

"read_only_allow_delete" : "true"

Example:

{
  "incident" : {
    "settings" : {
      "index" : {
        "blocks" : {
          "read_only_allow_delete" : "true"
        }
      }
    }
  }
}

Remove the restriction for all indices:

sudo curl -k -X PUT -H "Content-Type: application/json" \
http://localhost:9200/_all/_settings \
-d ' {"index.blocks.read_only_allow_delete": null} '

Verify the lock has been removed:

sudo curl -k -X GET "http://localhost:9200/incident/_settings?pretty"

The following should no longer be present:

"read_only_allow_delete" : "true"

Restart the services:

sudo systemctl restart resilient
sudo systemctl start restrict-elastic

Rebuild Search Index

After unlocking the indices, new data will be indexed immediately. However, data created while the indices were locked will not be indexed.

A full reindex is required.

Run:

sudo resutil configset -key elastic_server.init_schema -bvalue true

Restart IBM SOAR:

sudo systemctl restart resilient

Search functionality resumes immediately after the commands are executed, but results may remain incomplete until the rebuild finishes.

The rebuild time depends on the amount of data stored.

Data is indexed from newest to oldest, so newer incidents become searchable before older incidents.