Factory-reset of Threat Prevention profiles?

[Danny]

I got a R81.20 environment and noticed that the Threat Prevention policy still contains a large number of legacy TP profiles from previous versions. These profiles are no longer in use, but unfortunately, they cannot be deleted easily – attempting to remove them causes the Publish operation to hang for hours and eventually fail with a timeout.

I would ideally like to reset the Threat Prevention profiles to the R8x factory defaults, meaning just the standard Basic, Optimized, and Strict profiles. However, I haven’t found a clean way to do this without performing a full management server reset, which I’d prefer to avoid.

I’ve already opened a SR with TAC, but I wanted to check here in case anyone has encountered a similar issue and found a workaround. Maybe it's possible to migrate-export to R82 without any Threat Prevention profiles or temporarily switch to Autonomous Threat Prevention to get rid of the legacy profiles?

Thanks in advance for any ideas or shared experiences!

[the_rock]

Maybe autonomous threat profile?

[Tal_Paz-Fridman]

Maybe deleting or "hiding" them using Database Tool (GuiDBEdit)?

Still, I would wait for official response from TAC.

[Wolfgang]

@Danny we had a similar problem in the past. Our solution:

- first remove all exceptions related to the TP profile you want to delete and publish

- remove only one TP profile at time and publish

I remember removing a profile took about 15min and publish another 10min. Some Smartconsole freeze during the process but the TP profile was deleted after that long time.