ibm.qradar.rule_info – Obtain information about one or many QRadar Rules, with filter options

Note

This plugin is part of the ibm.qradar collection (version 1.0.3).

To install it use: ansible-galaxy collection install ibm.qradar.

To use it in a playbook, specify: ibm.qradar.rule_info.

New in version 1.0.0: of ibm.qradar

Synopsis

  • This module obtains information about one or many QRadar Rules, with filter options

Parameters

Parameter Choices/Defaults Comments
id
integer
Obtain only information of the Rule with provided ID
name
string
Obtain only information of the Rule that matches the provided name
origin
string
    Choices:
  • SYSTEM
  • OVERRIDE
  • USER
Obtain only information of Rules that are of a certain origin
owner
string
Obtain only information of Rules owned by a certain user
type
string
    Choices:
  • EVENT
  • FLOW
  • COMMON
  • USER
Obtain only information for the Rules of a certain type

Notes

Note

  • You may provide many filters and they will all be applied, except for id as that will return only the Rule identified by the unique ID provided.

Examples

- name: Get information about the Rule named "Custom Company DDoS Rule"
  ibm.qradar.rule_info:
    name: "Custom Company DDoS Rule"
  register: custom_ddos_rule_info

- name: debugging output of the custom_ddos_rule_info registered variable
  debug:
    var: custom_ddos_rule_info

Authors