The IBM® QRadar® Use Case Manager app has required information for known issues.
The following table lists the known issues.
|Extension management export tasks don't work in QRadar 7.4.3 FP7 and 7.5.0
When you export multiple or single rules in a zip file, the export gets stuck, and never remains in a 'processing' state.
|Flows are not enabled in IBM
QRadar on Cloud
Flows are not enabled in QRadar on Cloud, but the flow rules are displaying in QRadar Use Case Manager. The workaround is to select all the rule types except Flows in the Type filter on the Use Case Explorer page.
|Unable to use APIs outside of QRadar in QRadar Use Case
In version 3.1.0, custom integrations might stop working, resulting in the inability to connect to the QRadar Use Case Manager APIs from outside your QRadar environment. The workaround in QRadar Use Case Manager 3.1.0 or later is to authenticate the API calls by using the same token that is used on the Configuration page (add a SEC header in the API call). If you upgrade to version 3.2.0 or later and use the token that you used to configure QRadar Use Case Manager, the custom integrations work.
|Commonly referenced elements appear with different names.
Commonly referenced elements, such as log sources, custom properties, or reference sets, can appear with old names in QRadar Use Case Manager and the rule details section in QRadar. QRadar Use Case Manager retrieves the names of elements that are referenced by rule tests from the text in the rule XML. When a referenced element changes its name, the text in the rule XML is not updated. As a work-around, you can edit the rule in the rule wizard in QRadar Use Case Manager and save it (click Finish without changing anything) to resolve the text mismatch.
QRadar Use Case Manager updates log source type names in the rule within 15 minutes of the update, or when you explicitly refresh the rule.
Tip: Add this filter to all of your report templates so that you don't need to keep manually selecting the filters.
|Unable to search for the forward slash character in regex.
The app cannot search for the forward slash character (/) in regular expressions. For example, on the Use Case Explorer page in the rule name or test definition in the filters, and rule name in the search bar of the table. As a work-around, use a question mark (?) as a wild character.
|Corrupted custom rule prevents QRadar from using related
A corrupted rule in QRadar prevents the QRadar API from returning required data. This prevents the QRadar Use Case Manager app from using rule-related functions.
|QRadar 7.3.3 FP4+, 7.4.0 FP2, and 7.4.1 and later.|