Release of QRadar 7.5.0 Update Package 16 SFS (2021.6.16.20260817115410)

Following changes in QRadar 7.5.0 UP15, high availability systems that host apps (either the Console or an Apphost) will now use the shared VIP IP address for any routing done by applications that communicate with the internet. This may cause issues with internet communication by QRadar apps in some environments.

If any 3rd party devices or software (VPN, firewall, etc.) are configured to use the HA host's physical IPs in order to allow internet communication from the QRadar host/apps, communication may break after upgrading to 7.5.0 UP15 if any such device is not expecting the VIP.

As the change implemented in 7.5.0 UP15 is by design, adjustments should be made on the 3rd party device(s) to factor in the VIP now being used for communication in between QRadar apps and the internet. IBM QRadar Support cannot assist with, or support 3rd party software.

The Known Issues listed below are resolved in QRadar 7.5.0 Update Package 16. For a complete list of Known Issues, see Known Issues. The Known Issues search page allows users to search for Known Issues by version or status.

Some Known Issues links might take 24 hours to display properly after a software release is posted to IBM Fix Central.

The following is a list of Known Issues fixed in QRadar 7.5.0 Update Package 16

• DT497240  Log Source Management incorrectly reports DSM updates as available when the latest version is already installed. 

• DT495631  QRadar: XML, generic list, NVP and calculated expression Tables Not Replicated from Console to Event Collector 

• DT448357  Inconsistent offense-event association causes inaccurate event counts on the offense summary page 

• DT471698  QRadar: Legacy patch mode skips or ignores manual input if the patch.conf file exists 

• DT471335  Forwarded Events will prefix the syslog header even if the RFC5424 syslog header is present which routes them to the incorrect log source on the destination system 

• DT466765  Configuration and Data Backups can fail after upgrading to UP15 IF01 

• DT465347  QRADAR-30521: Backup and Restore | POST API | Backup API to take config backup fails with 500 Internal server error 

• DT464621  Report PDF generation fails with `fo:static-content is not a valid child of fo:table-body` when report data spans multiple page sequences 

• DT462750  Offense Summary charts display counts from all domains instead of filtering by user's security profile domain 

• DT461409  Report generation fails when payload contains special characters 

• DT461358  While deleting/modifying a Custom Event Property the Dependency check sometimes fails displaying the message "Error occurred while searching for dependents." 

• DT465829  Dependency Check Inconsistent When Disabling a CEP 

• DT461479  Event Export link in EMail points to the IP Address and not the FQDN of the QRadar Console sometimes leading to broken links 

• DT460478  QRadar: jsch jar removed from ecs-ec-ingress packaging in UP14 IF02 

• DT462547  TCPSyslog: Blank Payload Events Visible When Empty Syslog Messages Are Received via UDP 

• DT457664  XML root element disappears from DSM Editor Workspace when using XML Expression with path "/", preventing accurate field extraction setup. 

• DT454995  Unable to update existing event regex properties using the API when the properties were originally created using an API token. 

• DT453707  Support for 0.0.0.0 and 255.255.255.255 IP addresses were removed following IPv6-related core changes, causing incorrect source IP handling in log activity 

• DT450797  After upgrade to 7.5.0 UP12, reports are queued and no report is executed with exception java.lang.NoClassDefFoundError: javax.xml.ws.Service 

• DT449628  DSM Editor crashes and becomes unstable when opened for Custom Log Source types due to bad regex parsing. 

• DT450475  When a rule is configured with an offense action or response and the offense is indexed on a custom property, but the triggering event has a null value for that custom property, the rule is incorrectly tagged as a partial match 

• DT448357  Inconsistent offense-event association causes inaccurate event counts on the offense summary page 

• DT433626  QRadar: CIDR Reference Sets used in rules and filters are not functioning correctly 

• DT425878  Reference Map of Maps filter does not match or exclude events in rules 

• DT444717  Issue where a monitor closes inactive protocol connections while the connection is being attempted can lead to event ingestion stopping 

• DT423485  Rules page is taking too long to load rules list and search bar. 

• DT397709 Changes in System Settings can be made using the mouse scroll wheel 

• DT391800  A syslog header created during offline forwarding will have the value of the source IP instead of the value of the log source identifier 

• DT391513  AQL properties do not parse and report 'N/A' in Log Activity 

• DT387264  Parsing disruption due to StackOverflowError from regular expression matching 

• DT386973  Order by column reset after navigating to page to of result set 

• DT378772  The removal dependency check does not look for "when the event matches this AQL filter query" when it is used by a custom rule. 

• DT257062  Unable to edit searches or add filters due to invalid characters in autodetected properties 

• DT252095  IJ49405: DEPENDENCY CHECKER CAN INCORRECTLY DELETE ONE OR MORE CUSTOM PROPERTIES WHEN DEPENDENCY EXISTS 

• DT495330  Hitting a max memory limit for imq service causing searches and deploy issues. 

QRadar 7.5.0 Update Package 16 resolves reported issues from users and administrators from previous QRadar versions. This cumulative software update fixes known software issues in your QRadar deployment. QRadar software updates are installed by using an SFS file, and update all appliances attached to the QRadar Console.

The 750-QRADAR-QRSIEM-2021.6.16.20260817115410 SFS file can upgrade the following QRadar versions to QRadar 7.5.0 Update Package 16:

This document does not cover all of the installation messages and requirements, such as changes to appliance memory requirements or browser requirements for QRadar. To review any additional requirements, see the QRadar Upgrade Guide.

See QRadar: Software update check list for administrators for a list of steps to review before you update your QRadar deployment.

Before you begin

Ensure that you take the following precautions:

• Back up your data before you begin any software upgrade. For more information about backup and recovery, see the QRadar Administration Guide.
• To avoid access errors in your log file, close all open QRadar sessions.
• The QRadar software update cannot be installed on a managed host that is at a different software version from the Console. All appliances in the deployment must be at the same software revision to update the entire deployment.
• Verify that all changes are deployed on your appliances. The update cannot install on appliances that have changes that are not deployed.
• If this is a new installation, review the instructions in the QRadar Installation Guide.

These instructions guide you through the process of upgrading an existing QRadar version to QRadar 7.5.0 Update Package 16. To update appliances in parallel, see QRadar: How to Update Appliances in Parallel.

Procedure

1. Download the software update to install QRadar 7.5.0 Update Package 16 from the IBM Fix Central website: 7.5.0-QRADAR-QRSIEM-20260817115410

   Important: Please confirm that you are installing the correct SFS file by checking the sha256sum value as found on Fix Central
   
   Note: To confirm QRadar 7.5.0 Update Package 16 is code signed by IBM, you must use the latest code signing utility 1.0.2. For more information, see https://ibm.biz/qradarcodesigning.
2. Use SSH to log in to your Console as the root user.

3. To verify you have enough space (10GB) in /store/tmp for the QRadar Console, type the following command:

     df -h /tmp /storetmp /store/transient | tee diskchecks.txt

   • Best directory option: /storetmp

     It is available on all appliance types at all versions. In QRadar 7.5.0 versions /store/tmp is a symlink to the /storetmp partition.

If the disk check command fails, retype the quotation marks from your terminal, then rerun the command. This command returns the details to both the command window and to a file on the Console named diskchecks.txt. Review this file to ensure that all appliances have at minimum 10GB of space available in a directory to copy the SFS before attempting to move the file to a managed host. If required, free up disk space on any host that fails to have less that 10GB available.

Note: In QRadar 7.3.0 and later, an update to directory structure for STIG-compliant directories reduces the size of several partitions. This can impact moving large files to QRadar.

1. To create the /media/updates directory, type the following command:

     mkdir -p /media/updates

2. Use SCP to copy the files to the QRadar Console to the /storetmp directory or a location with 10GB of disk space.

3. Change to the directory where you copied the patch file. For example,

     cd /storetmp

4. To mount the patch file to the /media/updates directory, type the following command:

     mount -o loop /storetmp/750-QRADAR-QRSIEM-2021.6.16.20260817115410.sfs /media/updates
   

5. To run the patch installer, type the following command:

     /media/updates/installer 

   Note: The first time that you run the software update, there might be a delay before the software update installation menu is displayed.

6. Using the patch installer, select all.
   • The all option updates the software on all appliances in the following order:
     1. Console
     2. No order required for remaining appliances. All remaining appliances can be updated in any order that you require.

   • If you do not select the all option, you must select your Console appliance.

     As of QRadar 7.2.6 Patch 4 and later, you are only provided the option to update all or update the Console appliance. Managed hosts are not displayed in the installation menu to ensure that the Console is patched first. After the Console is patched, a list of managed hosts that can be updated is displayed in the installation menu. This change was made starting with QRadar 7.2.6 Patch 4 to ensure that the Console appliance is always updated before managed hosts to prevent upgrade issues.

     If you want to patch systems in series, you can update the Console first, then copy the patch to all other appliances and run the patch installer individually on each managed host. The Console must be patched before you can run the installer on managed hosts. When updating in parallel, there is no order required in how you update appliances after the Console is updated.

     If your Secure Shell (SSH) session is disconnected while the upgrade is in progress, the upgrade continues. When you reopen your SSH session and rerun the installer, the patch installation resumes.

1. After the system reboot is not initiated after the patch completes and you have exited the installer, type the following command:

     umount /media/updates

2. Clear your browser cache before you log in to the Console.
3. Delete the SFS file from all appliances.
4. For administrators with managed WinCollect 7 agents, upgrades to 7.5.0 Update Package 16 require WinCollect version 7.3.1 Patch 4. Depending on your upgrade path, you might be required to update your WinCollect agent version on the Console. For more information, see the WinCollect 7.3.1 Patch 4 release notes.
5. To run AQL queries that use geographic data or the flags on the Log Activity tab, update to the latest database from Maxmind after you upgrade to QRadar 7.5.0 Update Package 16. 
    

Results

A summary of the software update installation advises you of any managed hosts that were not updated. If the software update fails to update a managed host, you can copy the software update to the host and run the installation locally.

After all hosts are updated, send an email to your team to inform them that they will need to clear their browser cache before they log in to the QRadar SIEM interface.

IBM QRadar SIEM contains components with known vulnerabilities

IBM QRadar SIEM contains components with known vulnerabilities

IBM QRadar SIEM could allow an authenticated user to obtain sensitive information from backup files due to incorrect permissions assignment.

IBM QRadar SIEM contains components with known vulnerabilities