Troubleshooting
Problem
Clients who create cases from offenses might find that when using QRadar Enhanced Data Migration or QRadar SIEM Functions for SOAR to return offense related information, no data is returned to the case. The same AQL sent later returns results.
Symptom
After the application runs, clients might expect the case to be populated with offense, event, flow or other information. In some instances, this information is not seen in the case although the application ran to completion. Further testing shows that results are returned for the same AQL.
Document Location
Worldwide
[{"Type":"MASTER","Line of Business":{"code":"LOB77","label":"Automation Platform"},"Business Unit":{"code":"BU048","label":"IBM Software"},"Product":{"code":"SSA230","label":"IBM Security QRadar SOAR"},"ARM Category":[{"code":"a8m0z000000cwqTAAQ","label":"Integrations-\u003EQRadar function"}],"ARM Case Number":"TS017120864","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"All Versions"},{"Type":"MASTER","Line of Business":{"code":"LOB77","label":"Automation Platform"},"Business Unit":{"code":"BU048","label":"IBM Software"},"Product":{"code":"SSTDPP","label":"IBM Cloud Pak for Security"},"ARM Category":[{"code":"a8m3p000000F8yEAAS","label":"Integration"}],"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"All Versions"}]
Log InLog in to view more of this document
This document has the abstract of a technical article that is available to authorized users once you have logged on. Please use Log in button above to access the full document. After log in, if you do not have the right authorization for this document, there will be instructions on what to do next.
Was this topic helpful?
Document Information
Modified date:
06 September 2024
UID
ibm17167741