This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

How to avoid active lists overwriting while upgrading ESM default content?

Hi all,

a couple of customers used to periodically upgrade the ESM default content packages (https://marketplace.microfocus.com/arcsight/content/esm-default-content) through the ESM console. The upgrade consists in the installation of the new package over the existing one, so all contents are overwritten, included active lists. For this kind of resource the problem is that the upgrade empty the content of the lists. Does anyone knows how to avoid this? A couple of ideas:

  • backup the AL before upgrading the package, and then restore them (that's what I have done last time)
  • import the package on ESM console whithout installing it, then install it deselecting in some way the AL

Any hints?

Thanks!

Alex

  • Hi Alex,

    There are 4 packages under default-content:

    Security Monitoring - Base

    Security Monitoring -Base - Active Lists

    Security Threat Monitoring

    Threat Intelligence Platform

    Only the active lists in the package "Security Monitoring - Base - Active Lists" will be overwritten during upgrade. The lists in other lists will be fine.

    Two methods can be used to back up lists before upgrade:

    - Use package to export the lists, make sure that the package format is default, and exclude other type of resources

    - If the number of lines is not big, select all entries, then export to a CSV file, you can import back later.

    Hope it is useful.

    Regards,

    Yun

  • Hi Yun,

    thanks for your answer. Actually I already applied the first suggestion, that is include the lists in a package and export it. After the "default content" upgrade I simply re-imported them. IMHO there should be an option to upgrade the package avoiding to overwrite lists, otherwise customers will risk to loose data.

    Thanks

    Alex