W3cubDocs

/Ansible

ibm.qradar.rule_info – Obtain information about one or many QRadar Rules, with filter options

Note

This plugin is part of the ibm.qradar collection (version 1.0.3).

You might already have this collection installed if you are using the ansible package. It is not included in ansible-core. To check whether it is installed, run ansible-galaxy collection list.

To install it, use: ansible-galaxy collection install ibm.qradar.

To use it in a playbook, specify: ibm.qradar.rule_info.

New in version 1.0.0: of ibm.qradar

Synopsis

  • This module obtains information about one or many QRadar Rules, with filter options

Parameters

Parameter Choices/Defaults Comments
id
integer
Obtain only information of the Rule with provided ID
name
string
Obtain only information of the Rule that matches the provided name
origin
string
    Choices:
  • SYSTEM
  • OVERRIDE
  • USER
Obtain only information of Rules that are of a certain origin
owner
string
Obtain only information of Rules owned by a certain user
type
string
    Choices:
  • EVENT
  • FLOW
  • COMMON
  • USER
Obtain only information for the Rules of a certain type

Notes

Note

  • You may provide many filters and they will all be applied, except for id as that will return only the Rule identified by the unique ID provided.

Examples

- name: Get information about the Rule named "Custom Company DDoS Rule"
  ibm.qradar.rule_info:
    name: "Custom Company DDoS Rule"
  register: custom_ddos_rule_info

- name: debugging output of the custom_ddos_rule_info registered variable
  debug:
    var: custom_ddos_rule_info

Authors

© 2012–2018 Michael DeHaan
© 2018–2021 Red Hat, Inc.
Licensed under the GNU General Public License version 3.
https://docs.ansible.com/ansible/latest/collections/ibm/qradar/rule_info_module.html