IBM Support

QRadar Support: How to reopen a support case for QRadar

How To


Summary

Users who have worked a case with IBM QRadar have 30 days after the case has been closed to reopen the issue. This technical note advises users what to include when they need to reopen a case with QRadar and how to proceed if your case is archived.

Steps

QRadar customers who have opened a case with QRadar Support have the option to reopen within 30 days of the case being closed.  Cases can be closed by the client or by QRadar Support after we have repeatedly attempted to contact users. In some scenarios, a case might need to be reopened after it is closed, such as the issue returned/occurred again on the system or contact is reestablished with the administrator of the QRadar appliance. Support cases can have two possible closed statuses assigned:
 

  1. Closed by (IBM or Client)
    Any case that is less than 30 days old from the initial closure can be reopened using the Reopen case button. The reopen case button is only available for 30 days from the date of closure at which the status transitions to Closed - Archived. 

    image-20190313152705-1

  2. Closed - Archived
    Cases that are 'Closed - Archived' cannot be reopened. If you experience an issue where a problem appears again and more than 30 days has elapsed there is no reopen button displayed the in the cases user interface. If your case has a status of 'Closed - Archived', QRadar Support recommends that you open a new case and explain this issue. Make sure you record the case number from your archived case and reference in your new support ticket.

    image-20190313152807-2


    How should QRadar users proceed if you cannot reopen your case?
    When you enter information for your new case, make sure you note in the business impact area that you are reopening a case that was previously closed and provide the case number (TS000xxxxxx) in your summary.

    In the section How is this issue impacting your business users can provide similar text as described below to inform us that you are experiencing a repeat issue. Ensure that you include an new symptoms or workarounds applied to QRadar in your new case. For example:

We are experiencing an issue for a case that was previously closed. It appears that the issue logged in TS000xxxxxx is still occurring on our appliance. Our previous case has a status of 'Closed - Archived' and cannot be reopened. We have attempted the reapplied the previous workaround with different results. If a support representative can contact us via phone at xxx-xxx-xxx or reach out to us via email ([email protected]) we'd like further assistance on this issue. New logs are attached to this case from the QRadar Console.

Document Location

Worldwide

[{"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"Component":"Support","Platform":[{"code":"PF016","label":"Linux"}],"Version":"All Versions","Edition":"","Line of Business":{"code":"LOB24","label":"Security Software"}}]

Document Information

Modified date:
07 January 2021

UID

ibm10876052