QRadar: "Failed to parse IP address" error for Custom Rule

Troubleshooting

Problem

Frequent errors in qradar.error like "Exception in rule <ruleID_number> - <rule_name>: Failed to parse IP address: <some_nonIP_value>"

For example,
[ecs-ep.ecs-ep] [CRE Processor [15]] com.q1labs.semsources.cre.CustomRule: [ERROR] [NOT:0000003000][xxx.xxx.xxx.xxx/- -] [-/- -]Exception in rule 123456 - My Rule Name: Failed to parse IP address: user0001

Symptom

Error logging grows rapidly, potentially increasing disk usage quickly on /var/log/ partition.

Cause

QRadar® cannot test a property containing string or numeric data against a reference set containing IP data.

Environment

QRadar® 7.3.x and greater

Diagnosing The Problem

Review the Custom Rule described in the error message for any tests matching this template:

and when any|all of these properties are contained in any|all of reference sets

For example,

and when any of Hostname, Source IP are contained in any of MyHostnameRefSet - AlphaNumeric, MyIPRefSet - IP

In this example, there is a property, Hostname, which contains string data, but we are attempting to compare to a reference set containing IP data, MyIPRefSet - IP.

Resolving The Problem

Rewrite the rule test so that only IP-type properties are compared to IP reference sets.

In the case where you need to consider multiple properties matching multiple reference set, use multiple building blocks and a Rule to build a "and when events match any of these rules" test.

For example,
In the Custom Rule "MyRule", we are comparing non-IP data in the Username property to the IP reference set MyIPRefSet, and need to rework the test to correctly handle the OR condition implied here.
and when any of Hostname, Source IP are contained in any of MyHostnameRefSet - AlphaNumeric, MyIPRefSet - IP

Create 2 separate Building Blocks. We call them MyBB1 and MyBB2 for the example:
1. MyBB1 would include the test:
  and when any of Hostname are contained in any of MyHostnameRefSet - Alphanumeric
2. MyBB2 would include the test:
  and when any of Source IP are contained in any of MyIPRefSet - IP
Replace the original test in MyRule with a new test from the template:
and when an event matches any|all of the following rules
Configured as follows:
and when an event matches any of the following MyBB1, MyBB2

Note: The Building Blocks still need to follow best practice guidance concerning efficient test ordering, and add extra tests as needed to make the Building Blocks more efficient.

Related Information

Tuning Custom rule testing order

Document Location

Worldwide

[{"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000GncCAAS","label":"QRadar-\u003ERules"}],"ARM Case Number":"TS003627121","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"All Version(s)","Line of Business":{"code":"LOB24","label":"Security Software"}}]

Tips