This article describes how to delete an organization from CLI if not successful from the GUI.
Scope
FortiSIEM.
Solution
Deleting an Organization from the GUI might fail because this Organization still has credentials and incidents mapped to it.
One way to delete the Organization from the GUI is to remove all credential mapping to this org and all related incidents before deleting it.
Or remove it from the database following the steps:
Take a snapshot of the complete VM to restore it in case of an issue.
Note down the Organization ID: Go under Admin -> Setup -> Organizations, note the Org ID, and replace it in the commands below (For example, Org id = 2002).
SSH to super as root, run the below:
psql -U phoenix -d phoenixdb delete from ph_incident_ticket2escalation_policy where ticket_id in (select id from ph_incident_ticket where cust_org_id=2002); delete from ph_incident_ticket_trail where cust_org_id=2002; delete from ph_incident_ticket where cust_org_id=2002; delete from ph_group_item where group_id in (select id from ph_group where cust_org_id=2002); delete from ph_group_item where cust_org_id=2002; delete from ph_group where cust_org_id=2002; \q
Delete the Org from the GUI.
Note that the events in the Org will not be deleted immediately, they will be purged according to the retention policy.
