W3cubDocs

/Ansible

ibm.qradar.rule module – Manage state of QRadar Rules, with filter options

Note

This module is part of the ibm.qradar collection (version 4.0.0).

You might already have this collection installed if you are using the ansible package. It is not included in ansible-core. To check whether it is installed, run ansible-galaxy collection list.

To install it, use: ansible-galaxy collection install ibm.qradar.

To use it in a playbook, specify: ibm.qradar.rule.

Note

The ibm.qradar collection has been deprecated and will be removed from Ansible 13. See the discussion thread for more information.

New in ibm.qradar 1.0.0

DEPRECATED

Removed in:

major release after 2024-09-01

Why:

Newer and updated modules released with more functionality.

Alternative:

qradar_analytics_rules

Synopsis

  • Manage state of QRadar Rules, with filter options

Aliases: qradar_rule

Parameters

Parameter

Comments

id

integer

Manage state of a QRadar Rule by ID

name

string

Manage state of a QRadar Rule by name

owner

string

Manage ownership of a QRadar Rule

state

string / required

Manage state of a QRadar Rule

Choices:

  • "enabled"
  • "disabled"
  • "absent"

Examples

- name: Enable Rule 'Ansible Example DDoS Rule'
  qradar_rule:
    name: 'Ansible Example DDOS Rule'
    state: enabled

Status

  • This module will be removed in a major release after 2024-09-01. [deprecated]
  • For more information see DEPRECATED.

Authors

© 2012–2018 Michael DeHaan
© 2018–2025 Red Hat, Inc.
Licensed under the GNU General Public License version 3.
https://docs.ansible.com/ansible/latest/collections/ibm/qradar/rule_module.html