Technical Tip: How to delete an organization from CLI

Description

This article describes how to delete an organization from the CLI if not successful from the GUI.

Scope

FortiSIEM.

Solution

Deleting an Organization from the GUI might fail because this Organization still has credentials and incidents mapped to it.

One way to delete the Organization from the GUI is to remove all credential mappings to this org and all related incidents before deleting it.

Or remove it from the database following the steps:

• Take a snapshot of the complete VM to restore it in case of an issue.

• Note down the Organization ID: Go under Admin -> Setup -> Organizations, note the Org ID, and replace it in the commands below (for example, Org ID = 2002).

• SSH to super as root, run the following:

psql -U phoenix -d phoenixdb
delete from ph_incident_ticket2escalation_policy where ticket_id in (select id from ph_incident_ticket where cust_org_id=2002);
delete from ph_incident_ticket_trail where cust_org_id=2002;
delete from ph_incident_ticket where cust_org_id=2002;
delete from ph_group_item where group_id in (select id from ph_group where cust_org_id=2002);
delete from ph_group_item where cust_org_id=2002;
delete from ph_group where cust_org_id=2002;
\q

• Go to Resource -> Reports -> Filter the organizations. Make sure all the scheduled is removed for the organization

• Delete the Org from the GUI.

Note that the events in the Org will not be deleted immediately; they will be purged according to the retention policy.