tag:blogger.com,1999:blog-7303400454979750101.post190551785964135512..comments2024-03-28T06:49:56.390-07:00Comments on Learning by practicing: Dumping All QRadar RulesNik Alleyne, MSc | CISSP | GC|IA|IH|REM|PENhttp://www.blogger.com/profile/10282323977269843041noreply@blogger.comBlogger5125tag:blogger.com,1999:blog-7303400454979750101.post-35868353813119206512024-01-10T07:02:53.829-08:002024-01-10T07:02:53.829-08:00There is a Use Case Manager app that allows you to...There is a Use Case Manager app that allows you to export rules, review active rules, and more. This is default to QRadar and there is no need to look at the custom rules database anymore.<br />Anonymousnoreply@blogger.comtag:blogger.com,1999:blog-7303400454979750101.post-70193083587973776772018-04-18T12:23:54.854-07:002018-04-18T12:23:54.854-07:00Andres,
Can you repost what you have? I'm look...Andres,<br />Can you repost what you have? I'm looking at redoing this but just cant seem to find the time to pay attention to it.Nik Alleyne, MSc | CISSP | GC|IA|IH|REM|PENhttps://www.blogger.com/profile/10282323977269843041noreply@blogger.comtag:blogger.com,1999:blog-7303400454979750101.post-20735088212803014972018-04-18T12:23:02.060-07:002018-04-18T12:23:02.060-07:00grep -Po "<rule.*</rule>"grep -Po "<rule.*</rule>"Anonymoushttps://www.blogger.com/profile/06159407381142253739noreply@blogger.comtag:blogger.com,1999:blog-7303400454979750101.post-44649896407981733432018-04-18T12:21:55.520-07:002018-04-18T12:21:55.520-07:00I have changed the 'grep "^"'. A...I have changed the 'grep "^"'. All rule blocks are build within the rule tagAnonymoushttps://www.blogger.com/profile/06159407381142253739noreply@blogger.comtag:blogger.com,1999:blog-7303400454979750101.post-33249545585632043772017-12-29T11:39:47.010-08:002017-12-29T11:39:47.010-08:00I tried this and all it exported were the Building...I tried this and all it exported were the Building Blocks (and a short list of them at that). Any ideas?centre21https://www.blogger.com/profile/12315920310829055119noreply@blogger.com