Do you backup your custom content?

[Yossi_Nagar]

Hi,

I’m looking for a way to back up my custom content - such as playbooks, lists, scripts, correlation rules, and more, to an external repository (GitHub, GitLab, Azure DevOps, etc.).

So far, I’ve had partial success with playbooks using Python scripts and API calls, but I’m having difficulty backing up the other content types.

Has anyone tried implementing something like this?

[susekar · Accepted solution]

Hello @Yossi_Nagar ,

Greetings for the day.

In Cortex XSIAM, backing up custom content to an external repository can be achieved through two primary methods: the native Remote Repository feature for specific supported content types, and a specialized API-based workaround for a comprehensive backup of all custom content.

1. Native Remote Repository Feature

Cortex XSIAM includes a built-in feature to manage and sync content between tenants (for example, Development to Production) using a Git-based repository such as GitHub, GitLab, Bitbucket, or Azure DevOps.

Supported Content Types

The following types can be pushed and pulled via the Remote Repository:

• Playbooks and Scripts

• Integrations

• Classifiers and Mappers

• Issue/Indicator Layouts, Types, and Fields

Unsupported Content Types

The native sync feature does not support:

• Correlation Rules

• Parsing Rules and Data Modeling Rules

• Lists and Dashboards

 

2. Automated Backup Workaround (API Method)

To back up the content types not supported by the Remote Repository (such as lists and correlation rules), you can automate the export of a Content Bundle and push it to your repository. This method uses the internal API to download all custom content in a single encrypted file.

Workflow for Automated Backup

Step 1: Download the Content Bundle

Create a playbook or script that uses the core-api-download command to target the /content/bundle endpoint:

core-api-download endpoint="/content/bundle"

Step 2: Commit to External Repository

Use an integration command (for example, from the GitHub or GitLab content packs) to upload the resulting file. Example using the GitHub integration:

github-commit-file filename="XSIAM_Backup.zip" content="${core-api-download.File}" repository="your-repo-name" branch="main" message="Daily automated backup"

Step 3: Schedule the Backup

Configure this playbook to run as a Job (for example, daily or weekly) under:

Settings → Configurations → Automation → Jobs

 

3. Manual Export Option

You can also manually export all custom content for backup purposes via the UI:

1. Navigate to Settings → Configurations → General → Server Settings.

2. Scroll to the Custom Content section.

3. Click Export all custom content to download a .tar file containing your custom playbooks, scripts, layouts, and other components.

Important Considerations

Correlation Rules: These often must be moved manually by copying the XQL query text.

Version Mismatch: It is not recommended to push or pull content between tenants running different XSIAM versions to avoid compatibility issues.

Permissions: Managing Remote Repository settings requires Instance Admin privileges or specific RBAC permissions for Remote Repository.

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution".

Thanks & Regards,
S. Subashkar Sekar

[Yossi_Nagar]

The best answer I got. 

Thank you for so detailed answer, I believe you covered everything here - I'll go and check all options you mentioned.

Appreciate that,

Thank you!