Restoring an account that is marked for deletion

When an IBM Security QRadar® Suite Software account is marked for deletion, it is no longer accessible. Accounts that are marked for deletion can be restored if you have the appropriate Red Hat® OpenShift® cluster administration access.

Before you begin

You must have access with the Kubernetes command-line interface tool to the Red Hat OpenShift cluster on which QRadar Suite Software is installed.


  1. To identify a running isc-entitlements pod, run the following commands:
    POD=$(oc get pods -lname=isc-entitlements -n=$<Namespace> --no-headers | grep -i running | head -1 | awk '{print $1}')
    echo $POD

    <Namespace> is the namespace where QRadar Suite Software is installed.

  2. Confirm that the result of step 1 is similar to the following output.

    If there is no output, run the following command:

    oc get pods -lname=isc-entitlements

    Verify that pods are present and are in a "Running" state. If no pods are in the "Running" state, see the instructions for running MustGather and contact IBM Support.

  3. To identify the ID for the account that you intend to restore, run the following command:
    oc exec $POD -n=$NAMESPACE -- node ./utilities/listAccountsPendingDeletion.js

    Obtain the ID from output, which is similar to the following example listing account IDs for each account name.

    │ (index) │               Account ID               │       Account Name       │
    │    0    │ '8adf5b33-b830-444f-ac81-9118acb04507' │ 'QRadar Suite Software'  │
    │    1    │ '8719f34e-f862-407b-a82e-a71ede6bb46f' │ 'Test account 1'         │
    │    2    │ '9379a824-68cd-4743-93fb-9d991725e0c4' │ 'Test account 2'         │
  4. Run the restoreAccount command with the account ID of the account you want to restore, as shown in the following example.
    oc exec $POD -n=$NAMESPACE -- node ./utilities/restoreAccount.js 8719f34e-f862-407b-a82e-a71ede6bb46f
    The following log output is an example of the output from the command.
    {"level":"info","message":"Successfully instantiate ChangeLogDB","ibm_datetime":"2020-11-09T17:45:40.786Z"} 
    {"level":"info","message":"Successfully restored account: 'Test account 1'","ibm_datetime":"2020-11-09T17:45:41.290Z"}

What to do next

Confirm that a user who was previously a member of the restored account can log in to that account.