IBM Support

IV82547: NETWORK ACTIVITY SEARCH FILTER 'WEB.APPLICATION.XJAVASCRIPT' SOMETIMES DOES NOT WORK AS EXPECTED

Subscribe

You can track all active APARs for this component.

 

APAR status

  • Closed as program error.

Error description

  • The Network Activity search filter Web.Application.XJAVASCRIPT
    does not work as expected in certain situations:
    
    Performing a Network Activity search with a 'Group By' of
    Application selected, then using drill down on the
    Web.Application.XJAVASCRIPT entry to see those specific
    results, a new window opens up and runs a new search that
    should filter for XJAVASCRIPT.  The filter instead changes to
    Web.Application.X, removing the word JAVASCRIPT.
    
    Messages similar to following might be visible in
    var/log/qradar.log when this issus is occurring:
    
    [tomcat] [admin@127.0.0.1 (9654857)
    /console/qradar/jsp/ArielSearchWrapper.jsp]
    com.q1labs.uiframeworks.util.HTMLUtils: [WARN]
    [NOT:0000004000][127.0.0.1/- -] [-/- -]Found illegal javascript
    statement in URL:
    https://127.0.0.1/console/do/ariel/arielSearch?appName=Surveilla
    nc
    e&pageId=FlowList&value(useColumns)=default&value(orderBy)=start
    Time&value(sorting)=desc&value(isDashboard)=false&value(isGlobal
    )=false&value(isQuickSearch)=false&value(isDefault)=false&value(
    searchId)=&dispatch=performSearch&reload=true&isModified=true&va
    lue(timeRangeType)=absolute&value(startTimeAbs)=1456132320000&va
    lue(endTimeAbs)=1456132620000&countDown=false&handleId=dbe9162b-
    9f82-43e4-97ea-cf402f85c614-ASYNCHRONOUS&value(searchName)=&valu
    e(application)=EQ%20Web.Application.XJAVASCRIPT&searchOrigin=SEA
    RCH_RESULTS_DETAILS_DRILLDOWN
    
    [tomcat] [admin@127.0.0.1 (9654857) /
    console/qradar/jsp/ArielSearchWrapper.jsp]
    com.q1labs.uiframeworks.util.HTMLUtils: [WARN]
    [NOT:0000004000][127.0.0.1/- -] [-/- -]URL has been modified
    to:
    https://10.10.10.10:443/console/do/ariel/arielSearch?appName=Sur
    ve
    illance&pageId=FlowList&value(useColumns)=default&value(orderBy)
    =startTime&value(sorting)=desc&value(isDashboard)=false&value(is
    Global)=false&value(isQuickSearch)=false&value(isDefault)=false&
    value(searchId)=&dispatch=performSearch&reload=true&isModified=t
    rue&value(timeRangeType)=absolute&value(startTimeAbs)=1456132320
    000&value(endTimeAbs)=1456132620000&countDown=false&handleId=dbe
    9162b-9f82-43e4-97ea-cf402f85c614-ASYNCHRONOUS&value(searchName)
    =&value(application)=EQ%20Web.Application.X&searchOrigin=SEARCH_
    RESULTS_DETAILS_DRILLDOWN
    

Local fix

  • Run a Network Activity search and then manually add the search
    filter 'Web.Application.XJAVASCRIPT' instead of using the Group
    By option.
    

Problem summary

  • This issue was resolved with QRadar/QRM/QVM/QRIF 7.2.8
    

Problem conclusion

  • This issue was resolved with QRadar/QRM/QVM/QRIF 7.2.8
    

Temporary fix

Comments

APAR Information

  • APAR number

    IV82547

  • Reported component name

    QRADAR SOFTWARE

  • Reported component ID

    5725QRDSW

  • Reported release

    724

  • Status

    CLOSED PER

  • PE

    NoPE

  • HIPER

    NoHIPER

  • Special Attention

    NoSpecatt / Xsystem

  • Submitted date

    2016-03-10

  • Closed date

    2016-09-28

  • Last modified date

    2016-09-28

  • APAR is sysrouted FROM one or more of the following:

  • APAR is sysrouted TO one or more of the following:

Fix information

  • Fixed component name

    QRADAR SOFTWARE

  • Fixed component ID

    5725QRDSW

Applicable component levels

  • R728 PSY

       UP

[{"Business Unit":{"code":"BU048","label":"IBM Software"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"Component":"","ARM Category":[],"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"724","Edition":"","Line of Business":{"code":"LOB24","label":"Security Software"}}]

Document Information

Modified date:
28 September 2016