Skip to main content
idabouzi
Staff
Staff
December 20, 2024

Technical Tip: How to delete Incident Cases from the Command line interface

  • December 20, 2024
  • 0 replies
  • 1417 views
Description This article describes how to delete Incident Cases from the Command line interface.
Scope FortiSIEM.
Solution

Some users may have a big number of cases, which they cannot delete from the GUI.

The following provides a solution to delete the cases from the backend based on their state:

 

  • Cases in 'New state':

 

psql -U phoenix phoenixdb -c "update ph_incident_ticket set ticket_state=2, closed_time=`date +%s%3N`,closenote='Closed by CLI' where ticket_state=0"

 

  • Cases in 'Assign state':

 

psql -U phoenix phoenixdb -c "update ph_incident_ticket set ticket_state=2, closed_time=`date +%s%3N`,closenote='Closed by CLI' where ticket_state=1"

 

  • Cases in 'Progress state':

 

psql -U phoenix phoenixdb -c "update ph_incident_ticket set ticket_state=2, closed_time=`date +%s%3N`,closenote='Closed by CLI' where ticket_state=3"

 

  • Cases in 'reopen state':

 

psql -U phoenix phoenixdb -c "update ph_incident_ticket set ticket_state=2, closed_time=`date +%s%3N`,closenote='Closed by CLI' where ticket_state=4"

    Thought Leadership Security Summit. Outpace New Threats with AI - enhanced defense. Tuesday, Septmeber 15, 8:30 AM - 2:30 PM PT. The Golf Club at Newcastle, WA.
    Virtual event | September 2026. SASE summit. The age of autonomous trust. Register here!