Technical Tip: Viewing FortiSIEM user list with creation date and last modified date

To view the FortiSIEM user list with creation date and last modified date by following the steps below:

SSH to the supervisor backend as root.

1. Run the command below.

psql -U phoenix phoenixdb

2. Run the query command below to retrieve user lists.

select * from ph_user;

3. To retrieve the creation and last modified dates, use the query command below:

select creation_time, last_modified_time from ph_user where cust_org_id=<ORG_ID>;

Replace it with the actual organization ID.

Example output:

After obtaining the results, proceed to paste the values into epoch timestamp Epoch Converter to convert to a human date.

An example using the value of 1750754598316:

GMT: Tuesday, June 24, 2025 8:43:18.316 AM
Your time zone: Tuesday, June 24, 2025 4:43:18.316 PM GMT+08:00 
Relative: 5 months ago

Additional information:

• Database queries should be executed carefully in production environments.
• Direct database access is intended for troubleshooting and advanced use cases only.
• For general user management, use the GUI: CMDB -> Users.

Note:

It is possible to obtain the date on human value by directly converting on the command on the way:

select to_char(to_timestamp(creation_time / 1000), 'DD/MM/YYYY HH24:MI:SS') as creation_time, to_char(to_timestamp(last_modified_time / 1000), 'DD/MM/YYYY HH24:MI:SS') as last_modified_time from ph_user where cust_org_id=<ORG_ID>;