Log in to the system by using the Sentinel Administrative User specified during installation (admin by default).

Select the Correlation tab.

Open the Correlation Engine Manager.

Right-click TestRule1 in the Correlation Engine Manager, then select Undeploy.

Open the Correlation Rule Manager.

Select TestRule1, then click Delete.

Select Tools > Action Manager to display the Action Manager window.

Select the CorrelatedEvent action, click Delete, then click Yes to confirm the deletion.

Select the Event Source Management menu, then select Live View.

In the Graphical event source hierarchy, right-click General Collector, then select Stop.

Close the Event Source Management window.

Click the Incidents tab.

Open the Incident View Manager.

Select TestIncident1, right-click, then select Delete.