Methods of importing and exporting content

You can use the following tools to import and export content in your IBM® QRadar® deployment.

Extensions Management tool

Use the Extensions Management tool to add extensions to your QRadar deployment. When you import content by using the Extensions Management tool, you can view the content before it is installed. If the content items exist in your system, you can specify whether to replace the content item or skip the update.

You cannot use the Extensions Management tool to export content.

Content management script

Use the content management script to export custom content from your QRadar deployment into an external, portable format. You can then use the script to import the custom content into another QRadar deployment. The script is useful when you want to automate moving content between your QRadar deployments.

The contentManagement.pl script is in the /opt/qradar/bin directory.

You must use the content management script to export content from the QRadar source deployment. You can use either the content management script or the Extensions Management tool to import the content to the target deployment.

DSM Editor

In QRadar V7.3.3 and later, you can export your custom content that you create in the DSM Editor. Click the Export button in the DSM Editor to export your content from one QRadar deployment to another, or to external media.

Note: You can export content from an earlier version of QRadar and import into a later version. However, you cannot import content from a later version into an earlier version.

Note: If you move overridden rules from one QRadar deployment to another, use the Replace Existing Content Items option to ensure that the rules are imported correctly.