Uninstall the Application

Perform the following steps to uninstall the application:

1. Uninstall the FIM application from Admin > Extension management. If you are asked to Remove or Preserve, then remove everything.
2. Check if all the CEPs are deleted for Qualys FIM JSON and Qualys FIM Incidents (whichever is required). Log source type in Admin > Custom Event Properties.
3. Delete the FIM app related:
4. Admin > Log Source.
5. Admin > Log Source Extensions.
6. Open the Admin > DSM Editor
   • Select the Qualys FIM JSON log source type. Check if all the custom fields are deleted and override fields are not overridden in the Properties tab.
   • AND
   • Select the 'Qualys FIM INCIDENTS' log source type. Check if all the custom fields are deleted and override fields are not overridden in the Properties tab.
   • Delete the Event mapping(s) related to the FIM app.
   • Disable:

     Configuration > Log Source Autodetection

     Configuration > Enable Log Source Autodetection.

7. Then delete the 'Qualys FIM JSON' and 'Qualys FIM Incidents' log source type in Admin > DSM Editor.
8. Log out.

In unfortunate cases, uninstalling the app should be done cleanly. Any leftover artifacts can interfere with the following installation attempt, creating an unstable state.

When the app gets installed, the following components get installed in QRadar, so to uninstall completely, the following components also need to be removed.

Related Topic

Install Application

‎