IBM Support

QRadar SOAR: Problems removing playbooks when uninstalling applications

Troubleshooting


Problem

When uninstalling an application, functions, workflows, message destinations, and other customizations are uninstalled. If the application created playbooks on installation, these playbooks are not removed on uninstallation. Furthermore, if the playbook references other customizations such as functions, message destinations, function inputs, scripts, and datatables, they are not removed either.

Symptom

When uninstalling an application the playbooks and other associated customizations that were created during the installation are not removed.

Cause

Playbooks are not properly tagged in the system when an application is installed. Due to this, playbooks are not properly linked to applications and thus are not removed when an application is uninstalled. Furthermore, the SOAR system does not currently allow for playbooks to be tagged with an application tag.

Environment

Applications installed that have playbooks.

Diagnosing The Problem

On uninstalling an application you notice that playbooks and other customizations associated with these playbooks are not removed.

Resolving The Problem

  1. Determine what playbooks were installed with the application
    1. This can be achieved by reference the applications documentation
  2. Delete the applications playbooks from the Playbooks page in the UI
  3. Uninstall the application
We plan to add this functionality in a later version so that uninstallation of applications removes all customizations.

Document Location

Worldwide

[{"Type":"MASTER","Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSIP9Q","label":"IBM Security SOAR"},"ARM Category":[{"code":"a8m0z000000cvqKAAQ","label":"Integrations"}],"ARM Case Number":"","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"All Versions"},{"Type":"MASTER","Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSEGM63","label":"IBM Security QRadar SOAR on Cloud"},"ARM Category":[{"code":"a8m0z000000cvqKAAQ","label":"Integrations"}],"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"All Versions"},{"Type":"MASTER","Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSTDPP","label":"IBM Cloud Pak for Security"},"ARM Category":[{"code":"a8m3p000000F8yEAAS","label":"Integration"}],"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"All Versions"}]

Document Information

Modified date:
31 July 2023

UID

ibm17015851