Syncing the configuration from the main site to the destination site

Many configuration items are kept synchronized between the main site and the destination site. The IBM® QRadar® Data Synchronization app uses limited configuration functionality to restore the configuration items when you run a configuration restore.

About this task

The following items can be restored to the destination site deployment from the main site:

  • Asset identity exclusions
  • Custom event and flow properties
  • Custom rules
  • Custom properties
  • Custom log source types
  • Custom QIDs
  • Custom event mappings
  • Domains and Multitenancy
  • FGroup data
  • Flow sources
  • Forwarding destinations
  • Historical rules and searches
  • Log source extensions
  • Log sources
  • Network hierarchy
  • Obfuscation data
  • Reference data
  • Reference sets
  • Report templates
  • Retention settings
  • Routing rules
  • Saved searches
  • System settings
  • Users configuration
Important: Do not run a configuration restore from the QRadar Backup and Recovery window on the Admin tab to synchronize your main site to the destination site. All configuration restores must be run from the Data Synchronization app because the content differs from the QRadar Backup and Recovery window.

Configuration synchronization is available after all managed hosts with QRadar Event Collector or QFlow components are paired.

Procedure

  1. On the destination site, click the menu Navigation menu icon icon.
  2. Click Restore on demand.
  3. Select the backup that you want to restore.
    Important: On IBM QRadar 7.5.0 Update Package 14 environment and Data Synchronization app configured with a 1:1 pairing, restoring the backup on a destination site might fail. As a workaround, contact Customer Support before you initiate the restore operation. For more information, see Known Issue IJ38806.
  4. Click Restore.
  5. In the confirmation window, click Restore.