Uninstalling the ThreatLockDown central components

You can uninstall all the ThreatLockDown central components using the ThreatLockDown installation assistant.

Run the assistant with the option -u or --uninstall as follows:

$ sudo bash wazuh-install.sh --uninstall

This will remove the ThreatLockDown indexer, the ThreatLockDown server, and the ThreatLockDown dashboard.

If you want to uninstall one specific central component, follow the instructions below.

Note

You need root user privileges to run all the commands described below.

Uninstall the ThreatLockDown dashboard

  1. Remove the ThreatLockDown dashboard installation.

    # yum remove wazuh-dashboard -y
# rm -rf /var/lib/wazuh-dashboard/
# rm -rf /usr/share/wazuh-dashboard/
# rm -rf /etc/wazuh-dashboard/

Uninstall the ThreatLockDown server

  1. Remove the ThreatLockDown manager installation.

    # yum remove wazuh-manager -y
# rm -rf /var/ossec/

  2. Disable the ThreatLockDown manager service.

    # systemctl disable wazuh-manager
# systemctl daemon-reload

  3. Remove the Filebeat installation.

    # yum remove filebeat -y
# rm -rf /var/lib/filebeat/
# rm -rf /usr/share/filebeat/
# rm -rf /etc/filebeat/

Uninstall the ThreatLockDown indexer

  1. Remove the ThreatLockDown indexer installation.

    # yum remove wazuh-indexer -y
# rm -rf /var/lib/wazuh-indexer/
# rm -rf /usr/share/wazuh-indexer/
# rm -rf /etc/wazuh-indexer/