IBM Support

IJ09316: [OFFENSE MANAGER] SOURCE IPS AND DESTINATION IPS DISPLAY 'UNAUTHORIZED' IN OFFENSES TAB FOR USERS WITH APPROPRIATE RIGHTS

Subscribe

You can track all active APARs for this component.

 

APAR status

  • Closed as Permanent restriction.

Error description

  • It has been identified that in the QRadar User Interface ->
    Offenses tab, Source IPs and Destination IPs column can display
    as "Unauthorized" for users that have appropriate security
    rights to see the IPs but where there is duplication in the
    network group names within Network Hierarchy assigned to the
    security profile.
    
    Example of Network Group Names where this issue is observed:
    DMZ.TEST,
    Server_Network.TEST,
    User_Network.TEST,
    
    Example of Network Group Names where working as expected:
    DMZ.TEST,
    Server_Network.TESTA,
    User_Network.TESTB,
    

Local fix

  • Avoid duplicate names within the Network Hierarchy, Network
    Group names.
    

Problem summary

  • This issue will not be fixed for now.
    Workaround:
    - Save off any duplicate network name that was not stored
    (missed) for the user
    - Add missing networks to the final list of user permitted
    networks
    

Problem conclusion

  • This issue will not be fixed for now.
    Workaround:
    - Save off any duplicate network name that was not stored
    (missed) for the user
    - Add missing networks to the final list of user permitted
    networks
    

Temporary fix

Comments

APAR Information

  • APAR number

    IJ09316

  • Reported component name

    QRADAR SOFTWARE

  • Reported component ID

    5725QRDSW

  • Reported release

    730

  • Status

    CLOSED PRS

  • PE

    NoPE

  • HIPER

    NoHIPER

  • Special Attention

    NoSpecatt / Xsystem

  • Submitted date

    2018-09-19

  • Closed date

    2020-07-13

  • Last modified date

    2020-07-13

  • APAR is sysrouted FROM one or more of the following:

  • APAR is sysrouted TO one or more of the following:

Fix information

Applicable component levels

[{"Business Unit":{"code":"BU053","label":"Cloud & Data Platform"},"Product":{"code":"SSBQAC","label":"IBM QRadar SIEM"},"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"730"}]

Document Information

Modified date:
14 July 2020