IBM QRadar

IBM QRadar

Join this online topic group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.


#Security
#QRadar
#SecuringhybridcloudandAI
 View Only
  • 1.  Import Network Hierarchy without deleting old data

    Posted 12/19/22 03:08 AM
    Hi everyone,
    we would like to import Network Hierarchy configuration from one QRadar to another but without erasing config on the destination QRadar. We would like to merge them instead of erasing existing configuration.
    PS : Our Network Hierarchy configuration is domain-aware

    ------------------------------
    Famara Bodian
    ------------------------------


  • 2.  RE: Import Network Hierarchy without deleting old data

    Posted 12/19/22 07:58 AM

    Hello Team,

    There is no direct method available. Earlier we had the Network Hierarchy management application available but now it's no longer functioning on the new version.

    However, you can follow the below approach. This is not a supported method.

    You can use the below API Endpoints, To get the existing Network Hierarchy, This will return you the existing network hierarchy information in JSON format.

    Staging : /config/network_hierarchy/staged_networks

    Production : /config/network_hierarchy/networks

    We can only update the staging endpoint using put, Once you update to verify that it's properly updated then do deploy which later updated the production endpoint.


    1. Get the networks from deployment A - Keep it as backup
    2. Get the networks from deployment B - Keep it as backup
    3. Manually merge the above two results, You may remove the duplicate entries. JSON format
    4. Then merged the JSON result you can upload using the put on the Staging endpoint. 
    5. Get the staging networks again and confirm if all are updated properly and no data loss.
    6. If all is good then only go for deploy changes
    7. Else use the backup to and put API to upload the backed-up hierarchy and then do a deployment.

    ----NOT SUPPORTED AND VERIFIED METHOD, TRY IT IN TESTING ENVIRONMENT FIRST====



    ------------------------------
    Vishal Tangadkar
    ------------------------------



  • 3.  RE: Import Network Hierarchy without deleting old data

    Posted 12/19/22 05:16 PM
    Hi Vishal,
    thank you for your reply.
    That's what I will try to achieve

    ------------------------------
    Famara Bodian
    ------------------------------



  • 4.  RE: Import Network Hierarchy without deleting old data

    Posted 12/19/22 07:59 AM
    Hi Famara,

    all you need is to merge your net-hier-source.csv and your net-hier-dest.csv in your new net-hier-final.csv with your domain-aware settings. Finally you'll need to convert this csv to a json file and update the network hierarchy of your destination qradar. Done.

    Here a blog post with possible options how to achieve your task:
    https://community.ibm.com/community/user/security/blogs/ralph-belfiore1/2022/11/10/network-hierarchy-management

    Regards,
    Ralph

    ------------------------------
    Ralph Belfiore
    SIEM Expert
    pro4bizz GmbH
    Karlsruhe
    +4972190981727
    ------------------------------



  • 5.  RE: Import Network Hierarchy without deleting old data

    Posted 12/19/22 04:21 PM
    Hi Ralph,
    thanks for your help. Effectively the blog post is great resource. Unfortunately I don't have a csv file but the JSON file after exporting by API.
    I would like to know if "id" et "network_id" are mandatory fields ? Because I think values will be different between two QRadar

    ------------------------------
    Famara Bodian
    ------------------------------



  • 6.  RE: Import Network Hierarchy without deleting old data

    Posted 12/19/22 04:55 PM
    Hello Famara,

    Required fields in the file are: 'GROUP', 'NAME', 'CIDR', 'DESCRIPTION', 'DOMAIN'.
    Your mentioned fields are not mandatory..

    Regards,
    Ralph

    ------------------------------
    Ralph Belfiore
    SIEM Expert
    pro4bizz GmbH
    Karlsruhe
    +4972190981727
    ------------------------------



  • 7.  RE: Import Network Hierarchy without deleting old data

    Posted 12/19/22 05:14 PM
    Thank you Ralph,
    I'll be trying it out

    ------------------------------
    Famara Bodian
    ------------------------------