Skip to main content

How to export content from a SIEM

S
Written by Sergey Bayrachny

You can import content into Custom Repositories on the SOC Prime Platform from a file. To do that, you first need to export the content from your SIEM/EDR/XDR/Data Lake. Below are the platform-specific instructions on exporting.

IBM QRadar

Export custom rules from IBM QRadar with QRadar's Content Management Tool. Before you begin, consider reading about best practices for using it and reviewing the general information on exporting content from IBM QRadar.

All Rules

To export all custom rules from your IBM QRadar:

  1. Use SSH to log in to IBM QRadar as the root user.

  2. Go to the /opt/qradar/bin directory and type the following command to export all custom rules:

    ./contentManagement.pl -a export --content-type customrule --id all

The content is exported to a ZIP file. Extract the XML from the ZIP file to later import it into the SOC Prime Platform.

To learn more about exporting all content of a specific type, see the official IBM QRadar documentation.

Specific Rules

To export specific custom rules from your IBM® QRadar®:

  1. Find the IDs of the rules you want to export:

    1. Use SSH to log in to QRadar as the root user.

    2. Go to the /opt/qradar/bin directory and type the following command to search for custom content that matches a regular expression:

      ./contentManagement.pl -a search -c customrule -r [regex]

      The search results list details, including the unique ID, for the content items that are found. For example:

  2. Export the rules

    1. Use SSH to log in to QRadar as the root user.

    2. Create a text file listing the content you want to export using the search results received in step 1. The file must include the custom content type (customrule) followed by a comma-separated list of unique IDs for that type. For example:

      customrule, 111352,111402,111202,100111,111002,111152,100307,100112,100308,110952,111102

    3. Go to /opt/qradar/bin and type the command to export the content:

      ./contentManagement.pl -a export -c package -f [source_file]

      where [source_file] is the case-sensitive path and file name of the text file that contains the list of custom rules that you want to export created in step 2b. For example:

      ./contentManagement.pl -a export -c package -f /qradar/exportlist.txt

      The content is exported to a compressed ZIP file. The exported file might contain more content items than expected because all dependencies are exported with the specified content items.

      Extract the XML from the ZIP file to later import it into the SOC Prime Platform.

To learn more, see the official IBM QRadar documentation on finding specific rule IDs and exporting specific rules.

Did this answer your question?