Upgrade, rollback and backup

An upgrade replaces only the images and deployment files. .env, the state/ directory and the Docker volumes are kept, so the license's host fingerprint does not change and no reactivation is needed.

Upgrade from 1.1.15 or earlier to 1.1.16

From 1.1.16 the release files, images and containers use the product name RST-AI-Copilot-for-QRadar, and the GitHub repository is Reallysec/RST-AI-Copilot-for-QRadar. On a gateway running 1.1.15 or earlier, the online update to 1.1.16 fails. Upgrade once by hand:

curl -fsSL https://github.com/Reallysec/RST-AI-Copilot-for-QRadar/releases/latest/download/install.sh | sudo bash

On an offline host, unpack the new archive into the existing installation directory and run ./deploy.sh there.

The script upgrades the existing /opt/rst-qradar-ai-copilot in place; data, license and host fingerprint are kept. Do not move or rename that directory: the compose project name and the data volumes follow the directory name, and state/ holds the host fingerprint, so a new directory means reactivating. From 1.1.16 on, online updates work as usual. Container names in commands change to rst-ai-copilot-for-qradar-*, for example docker exec rst-ai-copilot-for-qradar-gateway.

Upgrade with the install command

Available starting with 1.0.1, for installs made with install.sh. New installs go to /opt/rst-ai-copilot-for-qradar; installs made with 1.1.15 or earlier are upgraded in place in /opt/rst-qradar-ai-copilot.

Steps

1. Run the install command again. Add --version <x.y.z> for a specific version:

   curl -fsSL https://github.com/Reallysec/RST-AI-Copilot-for-QRadar/releases/latest/download/install.sh | sudo bash

2. When deploy.sh asks whether to keep the existing .env, keep it.

The script removes the old image tars from the directory, unpacks the new archive, loads the new images, switches GATEWAY_IMAGE_TAG to the new version, restarts and prints the running version.

Upgrade from an archive

Steps

1. Unpack the new archive into the existing installation directory:

   tar xzf RST-AI-Copilot-for-QRadar-<new-version>.tar.gz --strip-components=1 -C <install-dir>
   cd <install-dir>
   sudo ./deploy.sh

2. When asked whether to keep the existing .env, keep it. When asked whether to upgrade to the new version, answer yes.

The script loads the newest image tar in the directory, restarts with --force-recreate, waits for the containers to become healthy and prints the running version. Old image tars can be deleted.

Upgrade from Community

Every edition uses the same archive. An administrator imports a Professional or Enterprise license on the License page. No reinstall is needed; data and the host fingerprint are kept.

Online update

Prerequisites

• The gateway host can reach github.com and release-assets.githubusercontent.com on 443. The release manifest and content packs are read from GitHub Releases, the same for every edition. Hosts activated offline do not check for updates.
• The gateway runs 1.1.16 or later. For 1.1.15 or earlier, see Upgrade from 1.1.15 or earlier to 1.1.16.

Steps

1. Under Version and updates in Settings, select Download and stage when a new version appears. The gateway verifies the signature and stages the image in ./release/ in the installation directory.

2. On the gateway host, in the installation directory, run:

   ./deploy/rst-update.sh

The script loads the staged image, switches GATEWAY_IMAGE_TAG and restarts. The upgrade succeeds after three consecutive successful health checks within 120 seconds; otherwise the script rolls back to the previous version. Run ./deploy/rst-update.sh --rollback to return to the previous version by hand.

Switch the image version by hand

Steps

1. Load the new image and update .env:

   docker load < RST-AI-Copilot-for-QRadar-images-<new-version>.tar
   sed -i 's/^GATEWAY_IMAGE_TAG=.*/GATEWAY_IMAGE_TAG=<new-version>/' .env

2. Run docker compose -f docker-compose.prod.yml up -d.

To roll back, set GATEWAY_IMAGE_TAG back to the previous version the same way. The gateway creates copilot.db tables as needed at startup, so an older version ignores tables added by a newer one.

What to back up

Events, offenses and rules in QRadar are not backed up by the gateway. The gateway's offenses are copies; if they are lost, the next sync fetches them again within RST_OFFENSE_INGEST_LOOKBACK, and only the AI summaries and dispositions are lost.

Back up the gateway state

Steps

1. In the installation directory, run:

   bash scripts/backup.sh /backup/rst-copilot

2. Restrict the backup directory: chmod 700 /backup/rst-copilot.

The script archives the whole gateway_state volume as gateway-state-<timestamp>.tar.gz and deletes archives older than 30 days from that directory. Without a directory argument it writes to ./backups. To run it daily, add a cron entry:

0 2 * * * cd <install-dir> && bash scripts/backup.sh /backup/rst-copilot >> /var/log/rst-backup.log 2>&1

Restore the gateway state

Steps

1. Run the restore script and restart the gateway:

   bash scripts/restore.sh /backup/rst-copilot/gateway-state-<timestamp>.tar.gz
   docker compose -f docker-compose.prod.yml restart gateway

2. Open License to confirm the license state, then open Offenses to confirm the dispositions are back.

Restoring to a different host changes the host fingerprint, so the license needs reactivation. For an online license, first select Deactivate this license under Deactivate on the old host.

Back up and restore the account table

docker exec rst-ai-copilot-for-qradar-userdb pg_dump -U rst rst_users > /backup/rst-copilot/users-$(date +%F).sql
docker exec -i rst-ai-copilot-for-qradar-userdb psql -U rst rst_users < users-<date>.sql

If the userdb_data volume is lost, the gateway still starts: it recreates the account table and restores the first administrator from .env. Other accounts are lost.

Retention

Data in copilot.db is removed automatically after these periods. To keep the audit trail longer, raise RST_AUDIT_RETENTION_DAYS and keep backups for the same length of time.