QRadar: Cannot install application by using the QRadar Assistant app due to an issue with API credentials

Troubleshooting

Problem

Administrators who try to upgrade or install an application by using the QRadar Assistant app can receive the error "Retry Update".

Symptom

The following image illustrates the Deployment Intelligence app not being upgraded and requesting to "Retry Update":
Deployment Intelligence app request retry update

Deployment Intelligence app request retry update

Diagnosing The Problem

Administrators run the following steps to confirm the issue:

Use SSH to log in to the QRadar Console as the root user.

Run the recon script to find the QRadar Assistant app-id:

/opt/qradar/support/recon ps

Output example:
Note: In this output, the app-id for QRadar Assistant is 1402.

App-ID  Name                                    Managed Host ID Workload ID             Service Name    AB      Container Name  CDEGH   Port    IJKL
1553    Deployment Intelligence                 53              apps                    qapp-1553       ++      qapp-1553       +++++   5000    ++--
1555    QRadar Log Source Management            53              apps                    qapp-1555       ++      qapp-1555       +++++   5000    ++++
1151    pulse.full_name                         53              apps                    qapp-1151       +-      qapp-1151       +-+--   5000    ----
1253    Threat Intelligence                     53              apps                    qapp-1253       ++      qapp-1253       +++++   5000    ++++
1153    QRadar Use Case Manager                 53              apps                    qapp-1153       +-      qapp-1153       +-+--   5000    ----
1402    QRadar Assistant                        53              apps                    qapp-1402       ++      qapp-1402       +++++   5000    ++++

Move to the QRadar Assistant application logs by using the cd command:
Note: Replace <id> with the app-id from step 2.
```
cd /store/docker/volumes/qapp-<id>/log
```
Example:
```
cd /store/docker/volumes/qapp-1402/log
```

Use the grep command to filter the logs:

grep -E 'XFE Creds' app.log

Output example:
Note: The following log is the indicator of the error.

[MainThread] [ERROR] [APP_ID:1402] [NOT:0000003000] download.py: accept_zip_license(): xfe_id: xxxxxxxxxxxxxxxxxxxxxx: Error: Failed to accept license - download.py: accept_zip_license(): Could not accept extension license before downloading. Possible issue with XFE Creds.

Result
Administrator confirmed the error and can continue with the Resolving The Problem section.

Resolving The Problem

Administrators must create new API credentials in IBM X-Force Exchange and update the API credentials in the QRadar Assistant app.

Create new API credentials

Administrator needs to generate new API credentials for the QRadar Assistant app by running the following steps:

Log in to the IBM X-Force Exchange.
Go to your profile and click Settings.
Click API Access and then click the Generate button:
Copy the API Key and Password and click API Documentation to validate the API credentials:
In the IBM X-Force Exchange API, paste the API credentials and click the Authenticate button:

Result
Administrator has new API credentials and can continue with the Update the API credentials section.

Update the API credentials in QRadar Assistant

Administrator needs to apply the new API credentials in the QRadar Assistant app by running the following steps:

Log in to the QRadar Console as an administrator.
Click the QRadar Assistant app icon:
Click the settings icon in the QRadar Assistant app:
Add the new API credentials in the API Authentications tab:
Verify the credentials and click the Save button:

Result
Administrator applied the API credentials for QRadar Assistant app and can now update or install applications. If the administrator continues to experience issues, contact QRadar Support for assistance.

Related Information

QRadar Assistant app

QRadar Deployment Intelligence app

IBM X-Force Exchange API

Document Location

Worldwide

[{"Type":"MASTER","Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000cwt3AAA","label":"QRadar Apps"}],"ARM Case Number":"","Platform":[{"code":"PF016","label":"Linux"}],"Version":"All Versions"}]

Tips