IBM Support

QRadar: Imported reference sets with blank values can cause watchlist display issues in UBA

Troubleshooting


Problem

In the User Behavior Analytics app, users might not display in the Watchlist on the UBA Overview tab. Missing users can occur when a reference set contains blank username in a UBA Watchlist. Administrators who experience blank Watchlists can review the UBA reference set data and remove blank entries.

Symptom

The users do not display in the Watchlist, rendering a blank window. This issue occurs, the following error displays in the app logs:
Poll.log
[sync_watchlist_membership.run] [ERROR] - Error adding members via reference set: 'NoneType' object has no attribute 'strip'

Document Location

Worldwide

[{"Type":"MASTER","Line of Business":{"code":"LOB77","label":"Automation Platform"},"Business Unit":{"code":"BU048","label":"IBM Software"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000cwt3AAA","label":"QRadar Apps"}],"ARM Case Number":"","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"All Versions"}]

Log InLog in to view more of this document

This document has the abstract of a technical article that is available to authorized users once you have logged on. Please use Log in button above to access the full document. After log in, if you do not have the right authorization for this document, there will be instructions on what to do next.

Document Information

Modified date:
25 October 2022

UID

ibm16587987