Technical Tip: How to extract customized rules

For backup purposes or to share the customized rules to another FortiSIEM, it can be useful to extract all the customized rules.

Follow these steps:

From the super CLI as root:

echo "<Rules>" > /tmp/customized_rules.xml

psql -U phoenix phoenixdb -tc "select rule_xml from ph_drq_rule where creation_type=1" | sed "s# *+##g" >> /tmp/customized_rules.xml

echo "</Rules>" >> /tmp/customized_rules.xml

Now list of all the customized rules are stored in this /tmp/customized_rules.xml.

To make sure the XML format content is correct to be re-imported, next command will show any error within the file:

xmllint --noout /tmp/customized_rules.xml

If no error is displayed, it means that file can be transferred with WinSCP and then imported from the GUI in Resources -> Rules -> More -> Import.