Content type identifiers for exporting custom content
When you export a specific type of custom content from IBM QRadar, you must specify the content type. You must use either the text identifier or the numeric identifier for the content type.
When you export content from a QRadar appliance, the content management script checks content dependencies, and then includes associated content in the export.
For example, when the content management script detects that a saved search is associated with a report that you want to export, the saved search is also exported. You can't export offense, asset, or vulnerability saved searches.
You use the content type identifier when you want to export all custom content of a specific type. If you want to export a specific content item from your QRadar deployment, you must know the unique identifier for that specific content item.
contentManagement.pl script for the -c
parameter.
| Custom content type | Text identifier | Numeric identifier |
|---|---|---|
| All custom content | all | Not applicable |
| Custom list of content | package | Not applicable |
| Dashboards | dashboard | 4 |
| Reports | report | 10 |
| Saved searches | search | 1 |
| FGroups 1 | fgroup | 12 |
| FGroup types | fgrouptype | 13 |
| Custom rules | customrule | 3 |
| Custom properties | customproperty | 6 |
| Log sources | sensordevice | 17 |
| Log source types | sensordevicetype | 24 |
| Log source categories | sensordevicecategory | 18 |
| Log source extensions | deviceextension | 16 |
| Reference data collections | referencedata | 28 |
| Custom QID map entries | qidmap | 27 |
| Historical correlation profiles | historicalsearch | 25 |
| Custom functions | custom_function | 77 |
| Custom actions | custom_action | 78 |
| Applications | installed_application | 100 |
| 1An FGroup is a group of content such as a log source group, reporting group, or search group. | ||