Troubleshooting Attack Timeline error messages

Attack Timeline may display various error messages during operation. This reference describes each error message, its possible causes, and resolution steps.

No milestones found

This message appears when the system cannot generate milestones for the offense.

Possible causes:

  • Offense has no events or flows yet
  • Events or flows not yet correlated to offense
  • All events or flows are identical (no changes to trigger milestone)

Resolution:

  1. Wait for events to be correlated to offense.
  2. Verify offense has events by checking offense details.
  3. Refresh timeline after events arrive.
  4. Check if offense is valid and active.

Offense could not be fully visualized due to high event or flow density

The message displays: The offense could not be fully visualized within {X} minutes due to high event/flow density. Please adjust the Attack Timeline parameters in System Settings and try again.

Possible causes:

  • Offense has millions of events or flows
  • Very high density of unique values in tracked fields
  • System resource constraints

Resolution:

  1. If the milestone generation process exceeds the configured timeout value, wait for the system load to decrease.
  2. Refresh the timeline.

User does not have the required permissions

This message appears when the user lacks necessary access rights.

Possible causes:

  • User role does not include offense viewing
  • Security Profile restricts access

Resolution:

  1. Contact your administrator to verify your user role includes offense viewing permissions.
  2. Verify your Security Profile allows access to Attack Timeline features.

Maximum concurrent milestone generation tasks limit reached

The message displays: Maximum concurrent milestone generation tasks limit reached. Please retry after some time.

Possible causes:

  • Multiple users generating timelines simultaneously
  • System configured with low concurrent task limit

Resolution:

  1. Wait a few minutes and try again.
  2. Check with other users about their timeline usage.
  3. Contact your administrator to increase the concurrent task limit if needed.

Milestone generation task was not found

This message appears when the system cannot locate the generation task.

Possible causes:

  • Task was manually deleted
  • System cleanup removed old tasks

Resolution:

  1. Click the refresh icon to create a new generation task.

Milestone generation task failed with an exception

The message displays: The milestone generation task failed with an exception. Please retry after some time.

Possible causes:

  • System error during processing

Resolution:

  1. Refresh the page.
  2. Try generating the timeline again.
  3. If you continue to experience the exception, contact support for additional troubleshooting.

Milestone generation task has an unknown status

The message displays: The milestone generation task has an unknown status. Please retry after some time.

Possible causes:

  • Task was manually deleted
  • System cleanup removed old tasks

Resolution:

  1. Click the refresh icon to create a new generation task.

Specified offense was not found

This error message originates from server-side validation. If the required offense ID is not available in QRadar, this error message displays.

Possible causes:

  • Offense was deleted
  • Invalid offense ID in URL

Resolution:

  1. Verify the offense still exists in the Offenses tab.
  2. Check that the offense ID is correct.
  3. Return to the Offenses list and select the offense again.

Specified milestone was not found

This message appears when the system cannot locate the requested milestone.

Possible causes:

  • Milestone was deleted
  • Timeline was regenerated
  • Invalid milestone ID

Resolution:

  1. Refresh the timeline to regenerate milestones.
  2. Verify the milestone ID is correct.

Error occurred while processing your request

The message displays: An error occurred while processing your request. Please retry after some time.

Possible causes:

  • Temporary system issue
  • Resource exhaustion

Resolution:

  1. Wait a few minutes and try again.
  2. Refresh the page.

Invalid request

The message displays: Invalid request. Please check your input and try again. This error message originates from server-side validation. If the API URL is modified or tampered with, the API treats the request as invalid and returns this error message as a bad request response.

Possible causes:

  • Corrupted URL parameters
  • Invalid filter syntax

Resolution:

  1. Verify the URL parameters are correct.
  2. Check the filter syntax for errors.
  3. Return to the Offenses list and select the offense again.

Failed to load attack timeline data

The message displays: Failed to load attack timeline data. Please try refreshing the page.

Possible causes:

  • Network connectivity issue
  • Unsupported browser problem

Resolution:

  1. Refresh the page by pressing F5 or Ctrl+R.
  2. Try a different browser if the issue persists.

Failed to load milestones

The message displays: Failed to load milestones. Please try again.

Possible causes:

  • Network timeout
  • Server not responding
  • Session expired

Resolution:

  1. Click the refresh icon.
  2. Check network connectivity.
  3. Log out and log back in.
  4. Contact your administrator if the error persists.