QRadar: How to fix Anomaly Engine events flooding the console

Resolving The Problem

1. SSH to QRadar as the root user.
2. Run the following command to ensure a backup folder exists:

   mkdir -p /store/IBM_Support

3. Run the following command to backup the global_views table:

   pg_dump -U qradar -t global_views > /store/IBM_Support/global_views.sql

4. Run the following query to get the id's of the anomaly detection engines that are running without a rule, note the id's:

   psql -Uqradar -c "select gv_id, records.record_id from (select record_id from global_views where record_id not in (select trim(both '\"' from (xpath('//persistMapBackedProperty[@key=\"sentryId\"]/text()',rule_data::text::xml))[1]::text)::int from custom_rule where rule_data::text ~* 'sentryId' and rule_type in (6,7,8) and rule_data::text ~* 'enabled=\"true\"') and data_type = 'SENTRY' and not deleted) records join (select unnest(xpath('//globalView/@id',a.gv))::text as gv_id, unnest(string_to_array(unnest(xpath('//globalView//*/@sentries',gv))::text,',')) as sentryid from (select unnest(xpath('//globalView',xml_data::text::xml)) as gv from global_views where data_type != 'SENTRY') a where xpath_exists('//globalView[.//*/@sentries]',gv)) gvs on gvs.sentryid::int = records.record_id;"

   Sample output:

    gv_id | record_id
   -------+-----------
    10084 |         2
   (1 rows)

    
5. Run the following command to disable the "sentry" records:

   psql -Uqradar -c "UPDATE global_views set deleted = true where not record_id in (select trim(both '\"' from (xpath('//persistMapBackedProperty[@key=\"sentryId\"]/text()',rule_data::text::xml))[1]::text)::int from custom_rule where rule_data::text ~* 'sentryId' and rule_type in (6,7,8) and rule_data::text ~* 'enabled=\"true\"') and data_type = 'SENTRY' and not deleted;"

   The sample output should be something like the following, and will reflect the number of results returned in the previous step:

   UPDATE 1

6. In the GUI, open Admin > Aggregated Data Management.
7. In the Display drop-down menu, select Aggregated Data View.
8. In the Quick Search box, enter the number of one of the GVs
9. Doubleclick on the entry for the Aggregated Data Id matching your GV.
10. In the Content Dependencies view, check the Search Details column. 
    1. If the column shows "n/a", click cancel, then select the entry for your GV and click Delete View. Click OK from the Confirm Deletion page.​
    2. If the column does not show "n/a". There are dependencies that need to be resolved. Contact Support for further assistance
11. If there were multiple GVs listed in the psql output, repeat the previous steps to search for, view, and delete the associated GVs.
12. Wait 5 minutes and then review the incoming ADE event volume. At this point, the excess events should have stopped.
    1. If the excess events are still coming in, push a Full Deploy, and then Restart Web Services from the Admin tab.