In the User Behavior Analytics app, users might not display in the Watchlist on the UBA Overview tab. Missing users can occur when a reference set contains blank username in a UBA Watchlist. Administrators who experience blank Watchlists can review the UBA reference set data and remove blank entries.
[sync_watchlist_membership.run] [ERROR] - Error adding members via reference set: 'NoneType' object has no attribute 'strip'
Resolving The Problem
- Log in to QRadar as an administrator.
- On the Admin tab, click the Reference Set Management icon.
- Locate the Reference Set used by the Watchlist. In this example, the Reference Set used is called "Usernames".
- Double-click the reference set to open up the Content tab.
- Click the Value column to filter blank values in ascending order.
- Select any rows that contain a blank Value column.
- Click Delete.
- Click the UBA tab.
- Click the Refresh icon or wait for the user interface to count down and update the user interface.
Confirm the Watchlist displays values correctly in the user interface. If you continue to experience Watchlist interface issues after you remove the blank entries from the Values column in the reference set, contact QRadar Support.
Was this topic helpful?
25 October 2022