IBM Security QRadar SOAR

 View Only
  • 1.  Import Overwriting Administrator Settings

    Posted Wed July 01, 2020 12:10 PM
    Hello everyone,

    I am using two Resilient server, one is Prod and the other is Dev.
    I sometimes export Administrator settings from Prod and import it to Dev to make two to be the same environment.
    Well I remember import overwriting was possible, but now it is not, it returns error that "there are already rules and workflows with the same names".
    So to make it possible to import the settings again I have to manually delete all the former rules and workflows in the settings imported.

    Do you know 
    1) if there is a way to automatically blow off all the settings to be blank
    2) if there is a way to import overwriting settings
    3) any way to easily make the two server have the same environment?

    Thank you.

    ------------------------------
    Hanyu Lee
    ------------------------------


  • 2.  RE: Import Overwriting Administrator Settings

    Posted Tue July 07, 2020 07:52 AM
    Unfortunately there is no way to "set to factory default" the customization settings.

    This message appears if an item was imported from one system into another and then 1) rename the item in one system and then 2) create a new item with the same name. In this case when importing, the system doesn't know if it should create a new item or rename the existing one.


    When you get these messages it is necessary to remove the offending items manually.

    Ben

    ------------------------------
    Ben Lurie
    ------------------------------