Troubleshooting QRadar Network Threat Analytics

The following information can help you troubleshoot and resolve problems with the IBM® QRadar® Network Threat Analytics app.

Network baseline creation fails
When QRadar Network Threat Analytics fails to create the network baseline, the home page does not show any findings. The baseline can fail when you do not have enough flow data in QRadar or when your certificate does not validate.
QRadar Network Threat Analytics home page does not show any findings
There are several reasons why the IBM QRadar Network Threat Analytics home page might not show any findings.
Baseline creation status does not show percent complete
If the estimation query fails, the baseline creation status might show only that the training is in progress and not show the percent complete. The baseline might be progressing normally even though the percentage is not displayed.
Traffic originates from an unknown location
In the QRadar Network Threat Analytics map view, network traffic is shown to originate from an Unknown location.
Baseline data is not retrieved
Sometimes when you view the Flow Record Analytics page, a No baseline data retrieved message is displayed and the data is not loaded on some or all flow records.
Removing remnant data after QRadar Network Threat Analytics is uninstalled
Correct analytics scoring in QRadar Network Threat Analytics depends on having an up-to-date network baseline. Remnant baseline data from previous installations will affect analysis scoring in future installations of the app.
Configuring permissions for global view queries
If you have a nonadmin security profile and cannot use global view queries, you must modify the global view queries on IBM QRadar Network Threat Analytics.

Parent topic: QRadar Network Threat Analytics app

Related concepts

QRadar Network Threat Analytics installations
IBM QRadar Network Threat Analytics traffic monitoring
QRadar Network Threat Analytics workflows

Related tasks

Updating the network baseline manually