FortiSIEM
FortiSIEM provides Security Information and Event Management (SIEM) and User and Entity Behavior Analytics (UEBA)
mbenvenuti
Staff
Staff
Article Id 364933
Description This article describes how to clear the baseline profile database.
Scope FortiSIEM.
Solution

Incidents raised with names like 'Sudden increase...' or 'Sudden decrease...' are defined by baseline rules. Those rules trigger statistics that are stored in a profile database and the changes are noticed along with the usual behaviors.

Those stats may need to be cleared to avoid wrong or inconsistent rule triggering.

 

To clear the baseline profile database, run the next commands from super CLI as root:

cd /opt/phoenix/cache

rm profile.db
rm profile.db-shm
rm profile.db-wal

rm daily.db
rm daily.db-shm
rm daily.db-wal

phtools --stop phReportMaster
phtools --start phReportMaster

 

After those commands, the profiles are cleared and restarted to create fresh statics.