QRadar: Application installation displays a warning that the extension is not signed by IBM

Resolving The Problem

• If the content you download is not from the IBM App Exchange, then the extension does not include IBM signatures.  As the application or content extension does not come from an official IBM source, such as early access distribution or sideloading an application, an installation alert is generated to warn the administrator.
• If content you download is from the IBM App Exchange and displays a code signing error, the application might need an update, experiencing an issue, or might be compromised. The installation alert displayed in QRadar 7.5.0 Update Pack 3 and later is intended to warn administrators before you install an extension. If you experience code signing issues on recently updated IBM applications, you can report the extension to the proper development team.
  
  Select one of the following options:
  • For IBM developed applications and content extensions

    Administrators who experience code signing errors on IBM applications or content extensions can report these issues to QRadar Support as a case. For more information, see QRadar: IBM application cases and support policies.
    
    
    Example of the Support field for IBM developed applications.

    
    Before you open a case
    MD5 hashes are provided in the X-Force App Exchange for all extensions. It is a best practice to confirm the application download matches the posted MD5 SUM before you open a case with the QRadar Support team. If the file hash matches and you experience code signing error messages for an IBM app, open a case for QRadar Support to confirm the issue for the IBM application or content extension.

    1. Open a case with QRadar Support (requires an IBMid).
    2. Provide a summary of the issue.
       
    3. Select your QRadar product.
    4. Select the application that generated the code signing error.
       
       Note: If the code signing issue is with a rule or custom property extension, select Content Extension.
    5. In the Case Description field, provide a description of the issue and a link to the application or content extension.
       
       Important: Confirm your phone number and email is correct before you submit your case. If there is an alternate contact or you expect to be unavailable, you can add contact information in your case description for another team member.
        
    6. Complete the form and click Submit case.
       
       Results
       The case is submitted for review to the QRadar Support team.

  • For third-party applications and extensions from IBM Business Partners

    Administrators who experience code signing errors for applications or content extensions developed by IBM Business Partners can contact the developer directly. For information, see QRadar: Third-party applications and support policies.

    Before you begin
    MD5 hashes are provided in the X-Force App Exchange for all extensions. It is a best practice to confirm the application download matches the posted MD5 SUM before you open a case with the QRadar Support team. If the file hash matches and you experience code signing error messages, contact the application developer for assistance.

    1. Navigate to the IBM X-Force App Exchange.
    2. Locate your application from the search bar.
    3. Review the Support field in the application sidebar to contact the developer. For example,
       
    4. Report the issue or open a case with the Third-party developer or IBM Business Partner designated in the Support field.
       
       Results
       The developer can confirm whether their app is properly code signed and reviewed by IBM to include the correct signatures. IBM Business Partners can submit an updated application or content extension to the X-Force App Exchange portal for validation. Optionally, IBM Business Partners can contact their Technology Assistance Program (TAP) development lead for assistance with code signing content for the X-Force App Exchange.