|
Verify Rule Deletion in Database. Use the following command to check if the rule still exists in the ph_drq_rule table in the database:
psql -U phoenix phoenixdb -c "select * from ph_drq_rule" --csv > /tmp/allrules.csv
Open the exported CSV file (/tmp/allrules.csv). Search for the rule name to confirm whether it exists in the current database. If the rule is not found in the database, proceed to the next step.
Sometimes, even after deletion from the database, a rule might still exist in a previous version of the FortiSIEM and continue to trigger incidents.
To stop this:
- Navigate to the incident page where the specific incident is listed.
- Locate and select the incident that is being triggered by the deleted rule.
- Select 'Actions'.
- Choose Disable Rule.
Once the rule is disabled from the incident interface, no further incidents should be triggered from the deleted rule.
Maintain an updated list of active rules to avoid confusion by running below command:
psql -U phoenix phoenixdb -c "select * from ph_drq_rule where active = 't';" --csv > /tmp/enablerule.csv
|
