Troubleshooting
Problem
Administrators are reporting Exception Reading CRE Rules, with rules that contain X-Force Threat Intelligence conditions.
Symptom
This error message is based on the default X-Force rules and can be found on the dashboard:
[ecs-ep.ecs-ep] [d9ec8361-b1eb-43d1-a372-38eb225ce9d2/SequentialEventDispatcher] com.q1labs.semsources.cre.CustomRuleReader: [ERROR] [NOT:0040023100][/- -] [-/- -]Exception Reading CRE Rules. The current rule set is incomplete because the following rule(s) failed to load: 1:[ID=117489,NAME="BB:Threats: Suspicious IP Network Traffic",PARENTS=[(ID=117639,NAME="Suspicious Network Traffic to Internal Web Server")]]2:[ID=114839,NAME="BB:BehaviorDefinition: Communication with a Potential Hostile Host (Flows X-Force Categorization)"]3:[ID=117239,NAME="BB:Threats: Suspicious Network Traffic",PARENTS=[(ID=117639,NAME="Suspicious Network Traffic to Internal Web Server")]]4:[ID=114939,NAME="BB:BehaviorDefinition: Communication with a Potential Hostile IP Address (Flows X-Force Categorization)"]. This list includes any parent rules which were consequently removed. To see the exceptions which caused this, view the error log. If this problem persists, please contact customer support.
Trace from /var/log/qradar.error:
[ecs-ep.ecs-ep] [d9ec8361-b1eb-43d1-a372-38eb225ce9d2/SequentialEventDispatcher] com.q1labs.semsources.cre.tests.AQL_Test: [ERROR] [NOT:0000003000][/- -] [-/- -]Failed to parse parameters of rule BB:Threats: Suspicious IP Network Traffic
[ecs-ep.ecs-ep] [d9ec8361-b1eb-43d1-a372-38eb225ce9d2/SequentialEventDispatcher] com.q1labs.frameworks.nio.exceptions.ExtendedRuntimeException: XForce_IP_Confidence function: Error during initialization null
[ecs-ep.ecs-ep] [d9ec8361-b1eb-43d1-a372-38eb225ce9d2/SequentialEventDispatcher] at com.q1labs.core.aql.XForce_IP_Confidence.initialize(XForce_IP_Confidence.java:60)
[ecs-ep.ecs-ep] [d9ec8361-b1eb-43d1-a372-38eb225ce9d2/SequentialEventDispatcher] at com.q1labs.frameworks.util.Utils.initialize(Utils.java:459)
[ecs-ep.ecs-ep] [d9ec8361-b1eb-43d1-a372-38eb225ce9d2/SequentialEventDispatcher] at com.q1labs.ariel.ql.parser.SingleArgAdapter.initialize(ScalarFunctionInfo.java:1266)
[ecs-ep.ecs-ep] [d9ec8361-b1eb-43d1-a372-38eb225ce9d2/SequentialEventDispatcher] at com.q1labs.ariel.ql.parser.ScalarFunctionPredicate.initialize(ScalarFunctionInfo.java:1368)
[ecs-ep.ecs-ep] [d9ec8361-b1eb-43d1-a372-38eb225ce9d2/SequentialEventDispatcher] at com.q1labs.frameworks.util.Utils.initialize(Utils.java:459)
[ecs-ep.ecs-ep] [d9ec8361-b1eb-43d1-a372-38eb225ce9d2/SequentialEventDispatcher] at com.q1labs.ariel.IndexPredicate.initialize(IndexPredicate.java:234)
[ecs-ep.ecs-ep] [d9ec8361-b1eb-43d1-a372-38eb225ce9d2/SequentialEventDispatcher] at com.q1labs.frameworks.util.predicate.AbstractCompositePredicate.initialize(AbstractCompositePredicate.java:45)
[ecs-ep.ecs-ep] [d9ec8361-b1eb-43d1-a372-38eb225ce9d2/SequentialEventDispatcher] at com.q1labs.frameworks.util.predicate.AbstractCompositePredicate.initialize(AbstractCompositePredicate.java:45)
[ecs-ep.ecs-ep] [d9ec8361-b1eb-43d1-a372-38eb225ce9d2/SequentialEventDispatcher] at com.q1labs.frameworks.util.predicate.AbstractCompositePredicate.initialize(AbstractCompositePredicate.java:45)
[ecs-ep.ecs-ep] [d9ec8361-b1eb-43d1-a372-38eb225ce9d2/SequentialEventDispatcher] at com.q1labs.frameworks.util.predicate.AbstractCompositePredicate.initialize(AbstractCompositePredicate.java:45)
[ecs-ep.ecs-ep] [d9ec8361-b1eb-43d1-a372-38eb225ce9d2/SequentialEventDispatcher] at com.q1labs.frameworks.util.predicate.AbstractCompositePredicate.initialize(AbstractCompositePredicate.java:45)
[ecs-ep.ecs-ep] [d9ec8361-b1eb-43d1-a372-38eb225ce9d2/SequentialEventDispatcher] at com.q1labs.frameworks.util.predicate.AbstractCompositePredicate.initialize(AbstractCompositePredicate.java:45)
[ecs-ep.ecs-ep] [d9ec8361-b1eb-43d1-a372-38eb225ce9d2/SequentialEventDispatcher] at com.q1labs.frameworks.util.Utils.initialize(Utils.java:459)
[ecs-ep.ecs-ep] [d9ec8361-b1eb-43d1-a372-38eb225ce9d2/SequentialEventDispatcher] at com.q1labs.semsources.cre.tests.AQL_Test.setParms(AQL_Test.java:71)
[ecs-ep.ecs-ep] [d9ec8361-b1eb-43d1-a372-38eb225ce9d2/SequentialEventDispatcher] at com.q1labs.semsources.cre.tests.CREEventTest.init(CREEventTest.java:123)
[ecs-ep.ecs-ep] [d9ec8361-b1eb-43d1-a372-38eb225ce9d2/SequentialEventDispatcher] at com.q1labs.semsources.cre.CustomRule.<init>(CustomRule.java:224)
[ecs-ep.ecs-ep] [d9ec8361-b1eb-43d1-a372-38eb225ce9d2/SequentialEventDispatcher] at com.q1labs.semsources.cre.CustomRuleReader.preProcessNewRules(CustomRuleReader.java:1171)
[ecs-ep.ecs-ep] [d9ec8361-b1eb-43d1-a372-38eb225ce9d2/SequentialEventDispatcher] at com.q1labs.semsources.cre.CustomRuleReader.readRules(CustomRuleReader.java:685)
[ecs-ep.ecs-ep] [d9ec8361-b1eb-43d1-a372-38eb225ce9d2/SequentialEventDispatcher] at com.q1labs.semsources.cre.CustomRuleReader.objectChanged(CustomRuleReader.java:1652)
[ecs-ep.ecs-ep] [d9ec8361-b1eb-43d1-a372-38eb225ce9d2/SequentialEventDispatcher] at com.q1labs.frameworks.events.config.ConfigurationChangeEvent.dispatchEvent(ConfigurationChangeEvent.java:125)
[ecs-ep.ecs-ep] [d9ec8361-b1eb-43d1-a372-38eb225ce9d2/SequentialEventDispatcher] at com.q1labs.frameworks.events.SequentialEventDispatcher$DispatchThread.run(SequentialEventDispatcher.java:129)
[ecs-ep.ecs-ep] [d9ec8361-b1eb-43d1-a372-38eb225ce9d2/SequentialEventDispatcher] Caused by: com.q1labs.core.aql.XForceManager$XForceManager$XForceFunctionsNotAvailableException: Client is not currently available, likely due to connection issues. See logs produced by com.q1labs.core.aql.XForceManager for details
Cause
For rules with X-Force conditions to work, the X-Force Threat Intelligence Feed needs to be enabled, and accessible from the console.
Diagnosing The Problem
To check whether the X-Force Threat Intelligence Feed is enabled from the GUI, follow these steps:
This information can also be found in
/opt/qradar/conf/nva.conf,
X_FORCE_FEED=yes
If X-Force Threat Intelligence Feed is enabled and these rules are still failing to load, a firewall might be blocking the connection. Make sure the console has access to the following servers:
| Server Contacted | Server Description |
|---|---|
| update.xforce-security.com | X-Force Threat Intelligence Feed update server for IP reputation and URL data |
| license.xforce-security.com | X-Force Threat Intelligence licensing server |
Resolving The Problem
Enable the X-Force feed from the system settings. If you're still having issues with these rules, and a firewall is not blocking the connection, Contact IBM QRadar Support.
Related Information
Document Location
Worldwide
[{"Type":"MASTER","Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000cwt3AAA","label":"QRadar Apps"}],"ARM Case Number":"","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"All Versions"}]
Was this topic helpful?
Document Information
Modified date:
24 March 2023
UID
ibm16857303