IBM QRadar SOAR

IBM QRadar SOAR

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only
  • 1.  Export/Import part of conent

    Posted Mon December 16, 2019 08:20 AM
    Hello there!
    I'm developing content (workflows,rules,fields,tasks,scripts etc.) for IBM Resilient and using test server for that. What is the best way to move the new content i've developed to the production server?
    As far as I know I can do this by exporting/importing only the specific content i require but the only proper way i know is to move all the content. I know that usually some of objects can be linked each to another but what if I have a content that works separately and doesn't need anything else. How can I export it?

    ------------------------------
    Igor Talankin
    ------------------------------


  • 2.  RE: Export/Import part of conent

    Posted Mon December 16, 2019 09:11 AM
    Hi Igor,

    If I understanding it right, export/import allows you to pick which one you want. You can pick a workflow, a rule, a field, or a script by itself. If you pick a function, it might pull in message destination automatically. But for the others, you can pick individual one. 

    Is this what you need? Or you might want to post a concrete example, and we can try to figure it out from there.

    Thanks,

    ------------------------------
    Yongjian Feng
    ------------------------------



  • 3.  RE: Export/Import part of conent

    Posted Mon December 16, 2019 09:39 AM
    If I go to 'Administrator Settings' -> 'Export' I will see only 4 options:
    • Layouts
    • Rules, Scripts, Message Destinations, Functions and Workflows
    • Phases and Tasks (Required when exporting rules and workflows)
    • Administrator Settings (Groups , Inbound Email , Timeframes, and Notifications)
    If I choose something from this list Resilient exports whole content but I don't need it.
    For example how can I export just 1 certain script and 2 tasks without anything else.

    ------------------------------
    Igor Talankin
    ------------------------------



  • 4.  RE: Export/Import part of conent

    Posted Mon December 16, 2019 09:48 AM
    Edited by System Admin Thu November 11, 2021 11:15 AM
    My bad. I've just found a decision.
    It's described in the 'Resilient IRP Function Developer Guide' section 5.7
    I need to export whole content to .res file then I have to use resilient-circuits extract command to extract certain objects and import them to the new system.

    ------------------------------
    Igor Talankin
    ------------------------------



  • 5.  RE: Export/Import part of conent

    Posted Mon December 16, 2019 10:59 AM
    Yes, that is the way to go.

    ------------------------------
    Yongjian Feng
    ------------------------------



  • 6.  RE: Export/Import part of conent

    Posted Tue December 17, 2019 11:00 AM
    1. Create an export for code generation. (Administrator Settings -> Organization -> Export).
    2. Then if you want to export a specific element use the api name of that element:
      -bash-4.2$ resilient-circuits extract --datatable "dt_utils_test_data_table" -o datatable.res --zip

    Unverified HTTPS requests (cafile=false).

    extract is based on the organization export from 2019-06-17 18:12:35.350000.

    Writing datatable.res.zip



    ------------------------------
    Elizabeth Hecht
    ------------------------------