IBM Support

QRadar: Threat Information Center Dashboard: XForce RSS Download Error



The user added the Internet Threat Information Center (XForce) to their dashboard, but an RSS error message is displayed.


The dashboard item shows the following error:

There was an error downloading the RSS feed for The log file in /var/log/qradar.log shows the following message:

Sep 5 08:29:14 IP Address [tomcat] [admin@IP Address (1005) /console/JSON-RPC/QRadar.getXForceFeedItem QRadar.getXForceFeedItem] com.q1labs.qradar.ui.dashboard.RssFeedItem: [WARN] [NOT:0000004000][IP Address/- -] [-/- -]Proxy request failed. Falling back to default HTTP request.


There are several potential issues related to X-Force:
This may be caused if the QRadar Console does not have access to the internet, since it requires http access to get the feed.

Resolving The Problem

Establish an internet connection to the QRadar console.

Where do you find more information?

[{"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Component":"Dashboard","Platform":[{"code":"PF016","label":"Linux"}],"Version":"7.3;7.2","Edition":"","Line of Business":{"code":"LOB24","label":"Security Software"}}]

Document Information

Modified date:
21 June 2018