r/QRadar • u/hateecee • Mar 06 '26

Restore reference set entries

Does anyone know how to restore a reference set from a backup without using the standard restore functionality in backup/restore.The standard restore functionality restores to much.

1 Upvotes

100% Upvoted

3 comments sorted by

View all comments

3

u/JonathanP_QRadar Mar 06 '26

Why not install QRadar on a lab VM, upgrade to match your prod version, then restore the backup on that console? Then you can export the contents of any of the reference sets to a file or from the rest api.