Hello community,

I am wondering what is the recommended process to update extensions/apps in a closed environment. I did not find a document saying how to do it. I don't have the possibility to configure a proxy.

Is it:
1 uninstall old version
2 install new version

or:
1 add new version to extensions
2 just install new version over old version

I'm asking this because I don't want to loose adjustment made to installed extensions. And the extension installer is not complaining if I'm adding the same extension in a different version to the installed one...

I just don't want to break anything.

Thank you,
Stefan

------------------------------
Stefan Haunß
------------------------------

Hi Stefan,

You can install a newer version of an extension overall an older version and QRadar will treat this like an upgrade for any apps within that extension, retaining any config or data but updating the app code. For rules, any customizations you've made will be preserved. However for other types of content, if you have modified what was installed by an extension and then install the next version of the extension, your customizations can be overridden by the latest "official" version of the content from the extension. If you have modified any saved searches or custom properties you may want to make copies before completing the extension install. The extension preview will tell you what items will be touched by the extension install.

Note that if you have v1 of an extension installed and then just upload v2 (without actually installing it), both versions will be displayed in Extensions Management, one with Status=Installedand one just in a staged state. However once you install v2, the v1 entry will disappear since v2 would have replaced it.

Cheers
Colin

------------------------------
COLIN HAY
IBM Security
------------------------------