infrastructure-notes/MDR Customer Decommision Notes.md

MDR Customer decommision Notes.txt

salt saf-splunk-syslog-* cmd.run 'systemctl stop syslog-ng' salt saf-splunk-syslog-* cmd.run 'systemctl disable syslog-ng' salt saf-splunk-dcn-* cmd.run 'docker stop mdr-syslog-ng'

salt saf-splunk-syslog-* cmd.run 'systemctl stop splunk' salt saf-splunk-syslog-* cmd.run 'systemctl disable splunk'

salt -C 'saf-splunk-* not .local' cmd.run 'systemctl stop splunk' salt -C 'saf-splunk- not .local' cmd.run 'rm -rf /opt/'

salt -C 'saf-splunk-* not .local' cmd.run 'rm -rf /var/log/' salt -C 'saf-splunk-* not *.local' cmd.run 'rm -rf /etc/salt/minion && shutdown now'

remove SG rules to block access. salt master and splunk indexers 12.42.184.208