Known issues

If you have more than 20k offenses, you might experience issues while loading the rule details page where some sections of the page keeps loading but does not complete. Eventually the app crashes and displays an error.

The workaround is to disable the offense contribution settings in the Performance configuration section of the configuration page.

When you export multiple or single rules in a zip file, the export gets stuck, and never remains in a 'processing' state.

In version 3.1.0, custom integrations might stop working, resulting in the inability to connect to the QRadar Use Case Manager APIs from outside your QRadar environment. The workaround in QRadar Use Case Manager 3.1.0 or later is to authenticate the API calls by using the same token that is used on the Configuration page (add a SEC header in the API call). If you upgrade to version 3.2.0 or later and use the token that you used to configure QRadar Use Case Manager, the custom integrations work.

Commonly referenced elements, such as log sources, custom properties, or reference sets, can appear with old names in QRadar Use Case Manager and the rule details section in QRadar. QRadar Use Case Manager retrieves the names of elements that are referenced by rule tests from the text in the rule XML. When a referenced element changes its name, the text in the rule XML is not updated.

If a rule or building block that is referenced in a test definition is manually updated in the database, the test definition can also appear with an old name.

As a work-around, you can edit the rule in the rule wizard in QRadar Use Case Manager and save it (click Finish without changing anything) to resolve the text mismatch.

QRadar Use Case Manager updates log source type names in the rule within 15 minutes of the update, or when you explicitly refresh the rule.

The app cannot search for the forward slash character (/) in regular expressions. For example, on the Use Case Explorer page in the rule name or test definition in the filters, and rule name in the search bar of the table. As a work-around, use a question mark (?) as a wild character.

A corrupted rule in QRadar prevents the QRadar API from returning required data. This prevents the QRadar Use Case Manager app from using rule-related functions.