Types of security content
IBM® QRadar® content is bundled into two types: content packs and extensions.
- Content packs
Security content packs contain enhancements to specific types of security content. Often, they include content for third-party integrations or operating systems. For example, a security content pack for a third-party integration might contain new custom event properties that make information in the event payload searchable for the log source and available for reporting.
Security content packs are available from IBM Fix Central (http://www.ibm.com/support/fixcentral). Content packs are not available as part of an auto-update.
- Extensions
IBM and other vendors write security extensions that enhance or extend QRadar capabilities. An extension can contain apps, content items, such as custom rules, report templates, saved searches, or contain updates to existing content items. For example, an extension might include an app to add a tab in QRadar that provides visualizations for an offense.
On IBM Security App Exchange, extensions are known as apps. You can download QRadar apps from IBM Security App Exchange and use the Extensions Management tool to install them. Apps are not available as part of an auto-update.
Sources of security content
- IBM Security App Exchange
- IBM Security App Exchange (https://apps.xforce.ibmcloud.com) is an app store and portal where you can browse and download QRadar extensions. It is a new way to share code, visualizations, reports, rules, and applications.
- IBM Fix Central
- IBM Fix Central (www.ibm.com/support/fixcentral) provides fixes and updates to your system software, hardware, and operating system. You can download security content packs and extensions from IBM Fix Central.
- QRadar deployments
- You export custom content from a QRadar deployment as an extension and then import it into another system when you want to reuse the content. For example, you can export content from your development environment to your production environment. You can use the content management script to export all content, or you can choose to export only some custom content.