Troubleshooting
Problem
When configuring the IBM Security QRadar SOAR plug-in installed on QRadar, you might come across a "QRadar token test failed" error.
Symptom
When configuring the plug-in, you might come across the error QRadar token test failed. 401 Client Error: 401 for url: https://<QRADAR.DOMAIN.COM>/api/siem/offense_closing_reasons
Cause
When the Authorized Service Token used by the plug-in is created with the wrong permissions this error is seen.
Diagnosing The Problem
In the QRadar console got to Admin - Authorized Services and check the User Role and Security Profile configured for the token the plug-in is configured to use.
If Admin is not set for both User Role and Security Profile, then this error occurs. You need to create a token with the correct permissions.
Resolving The Problem
Create a new token with Admin permissions for both User Role and Security Profile and use this token in the plug-in.
If you use IBM QRadar on Cloud (QRoC), you cannot create a token with the full level of access the plug-in needs. You must create a support case by using the QRoC product requesting that a new token is created with full access. Once the new token is provided use it in the plug-in.
Document Location
Worldwide
[{"Type":"MASTER","Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSA230","label":"IBM Security QRadar SOAR"},"ARM Category":[{"code":"a8m0z0000001gyGAAQ","label":"Integrations-\u003EQRadar app"}],"ARM Case Number":"","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"All Versions"},{"Type":"MASTER","Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSEGM63","label":"IBM Security QRadar SOAR on Cloud"},"ARM Category":[{"code":"a8m0z0000001gyGAAQ","label":"Integrations-\u003EQRadar app"}],"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"All Versions"},{"Type":"MASTER","Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSTDPP","label":"IBM Cloud Pak for Security"},"ARM Category":[{"code":"a8m0z0000001h8pAAA","label":"Cases"}],"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"All Versions"}]
Was this topic helpful?
Document Information
Modified date:
28 July 2022
UID
ibm16607860