Clean attack records from MongoDB

By default, when we install MongoDB usually you can connect with command mongosh from root  (without args).

Or with stored for FastNetMon password with

mongosh --username administrator --password $(cat /etc/fastnetmon/keychain/.mongo_admin)

command or with

mongosh --username fastnetmon_user --password $(cat /etc/fastnetmon/keychain/.mongo_fastnetmon_password)

After you connected to MongoDB, to clean all attack records run

use fastnetmon
db.attacks.drop()

To find and delete more specific records by IP -

use fastnetmon
db.attacks.find({ip:"IP"})
db.attacks.deleteMany({ip:"IP"})

or by attack uuid -

use fastnetmon
db.attacks.find({"attack_details.attack_uuid": "ATTACK_UUID"})
db.attacks.deleteMany({"attack_details.attack_uuid": "ATTACK_UUID"})