Your application workflows will stop functioning when the certificate is changed on your IBM Security Qradar SOAR Server. On App Host you have 2 options, uninstall and reinstall your applications or edit and add the new SOAR certificate to cert.cer file for each application.

K3s generates internal certificates with a 1-year lifetime. Restarting the K3s service automatically rotates certificates that expired or are due to expire within 90 days.

Customer set the proxy configuration at App Host and is getting the following error on App Host: “The App Host is paired but communication has not yet been successful.”

Unable to pair an App Host with sudo manage AppHost installation in IBM Security Orchestration, Automation, and Response (SOAR).

You receive an error installing applications in IBM Security QRadar SOAR, Administrator settings>Apps tab

This article provides the steps when the integration or app host failed after the API key expired

When there are configuration problems related to the mapping template in the IBM QRadar plug-in and configuration of IBM QRadar SOAR or Cloud Pak for Security, offenses might not escalate successfully. This document helps you identify and troubleshoot these situations.

How does the IBM QRadar SPAR plug-in decide which offenses to escalate?

This article provides general information as to how to customize the IBM Resilient QRadar application template.

A nonadmin user in QRadar might see “Offense with id xxxx not found” appear when manually escalate an offense to IBM QRadar SOAR. The incident is not created.

If a file called consolecert.pem is present in the plug-in’s app container and this file is different from the SSL certificate of the QRadar console, the plug-in is not able to communicate securely with the QRadar console.

For a new Qradar and SOAR integration environment, the synchronization from Qradar to SOAR works fine but the actions from SOAR to Qradar stay in “Pending” state.

Collect troubleshooting data for problems with IBM Security SOAR AppHost. Gathering this information before you contact IBM support helps familiarize you with the troubleshooting process and save you time.

Use this document to collect logs for IBM Security QRadar SOAR.

Use this document to collect logs for IBM Resilient Circuits.

What information does IBM support require to assist troubleshooting a problem related to the IBM QRadar Security SOAR application?

Use this document to collect logs for IBM Security QRadar SOAR Disaster Recovery (DR).