Uninstalling a content extension

Remove a content extension that isn't useful anymore or that adversely impacts the system. You can remove rules, custom properties, reference data, and saved searches. You might not be able to remove some content if another content item depends on it.

About this task

When you uninstall a content extension, any rules, custom properties, and reference data that were installed by the content extension are removed or reverted to their previous state. Saved searches can't be reverted. They can only be removed.

For example, if you've edited custom rules in an app that you now want to uninstall, you can preserve the changes you made for each customized rule. If the custom rule previously existed on the system, you can revert the rule to its previous state. If the custom rule didn't previously exist, you can remove it.

Note:

If you have introduced an outside dependency on a content extension that is installed by the app, QRadar® doesn't remove that piece of content when you uninstall the app. For example, if you create a custom rule that uses one of the app's custom properties, that custom property isn't removed when you uninstall the app.

Procedure

  1. On the navigation menu ( Navigation menu icon ), click Admin.
  2. In the System Configuration section, click Extensions Management.
  3. Select the extension that you want to uninstall and click Uninstall.
    QRadar checks for any applications, rules, custom properties, reference data, and saved searches that are installed by the content extension that can be removed.
  4. If you have manually altered any rules, custom properties, or reference data after you installed the app, choose whether to Preserve or Remove/Revert that content extension.
  5. Click Uninstall, and then click OK.