Technical Tip: How to delete External Threat Feed in FortiManager via Script

[haziqsulaiman]

Description	This article describes how to delete External Threat Feed object(s) using Scripts in FortiManager.
Scope	FortiManager
Solution	Users may encounter an issue where External Threat Feed cannot be deleted even after all the policy references have been removed. When trying to delete the object, FortiManager might show that it is referenced to the 'system external-resource' as shown below: In this scenario, a script can be created to delete the Threat Feed object from the ADOM database. Scripts can be created by going under FortiManager, going to the correct ADOM -> Device Manager -> Scripts. Since the External Threat Feed object is stored in the ADOM database of FortiManager, it must be run on the ADOM database. An example of such a script is shown below: The script can then be run by selecting the Script -> Run Script -> Run Script on the policy package: select any Policy Package -> Run Now. Note: Make sure the Threat Feed is not referenced in any policies in FortiManager. The script will fail to run if the object is referenced to policies. After running the script, the External Threat Feed will be deleted from FortiManager.