IBM QRadar

IBM QRadar

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only
Back to discussions
Expand all | Collapse all

Centralized list of all QID numbers & description

  • 1.  Centralized list of all QID numbers & description

    Posted Mon January 29, 2018 06:19 PM

    I'm working with the QRadar tool. I'd like to know if there is a centralized list of all QID numbers and a description anywhere?



  • 2.  RE: Centralized list of all QID numbers & description

    Posted Mon January 21, 2019 08:20 PM
    Hi,
    this link will help you.
    https://www-01.ibm.com/support/docview.wss?uid=swg21988758

    In case the link dies, here's a copy-paste of what you'll find.

    To export a list of Custom QIDs:
    1. Using SSH, log in to the QRadar Console as the root user.
    2. From command line run one of the commands below.

    List of Category Types:
    /opt/qradar/bin/qidmap_cli.sh -l > /tmp/Category_type_CLI.txt

    Export user created QIDs:
    TXT: /opt/qradar/bin/qidmap_cli.sh -e -f /tmp/UserCreated_QID_CLI.txt
    CSV: /opt/qradar/bin/qidmap_cli.sh -e -f /tmp/UserCreated_QID_CLI.csv
    ***Results: The file with QID information will be in /tmp


    To view QIDs and the related event name:
    An alternate method to view QIDs, is to use the idlist utility. This utility allows users to view existing QIDs in QRadar.
    1. Using SSH, log in to the QRadar Console as the root user.
    2. To view the full list of QIDs, type: ./opt/qradar/bin/idlist.sh -e qid
    3. A list of QIDs is printed to the screen.
    4. Press Space to page down through the list of QIDs.
    5. To search the list, type /search_term and then press Enter. For example, /malware.
    6. Press q to exit the list at any time.

    ------------------------------
    Anthony Gayadeen
    ------------------------------

    Original Message