IBM Support

Cloud Pak for Security: E_LOCKED_OUT Error

Troubleshooting


Problem

Apps redirect to QRadar Proxy error in Cloud Pak for Security (CP4S):
"An error has occurred while displaying content from QRadar. 
Either return to the homepage and try again or check your settings in the QRadar Proxy configuration. Error code: E_LOCKED_OUT."

Symptom

  • From the My applications page, under Worldwide Malicious Activity, error:
    "There was an error retrieving the data.
    402 Payment Required"
    There was an error retrieving the data. 402 Payment Required
  • Apps, such as User Behavior Analytics (UBA), redirects to a QRadar Proxy error:
    "An error has occurred while displaying content from QRadar. 
    Either return to the homepage and try again or check your settings in the QRadar Proxy configuration. Error code: E_LOCKED_OUT."
    An error has occurred while displaying content from QRadar.  Either return to the homepage and try again or check your settings in the QRadar Proxy configuration. Error code: E_LOCKED_OUT.
  • QRadar Proxy configuration displays:
    Connected for QRadar API
    Disconnected for Status for QRadar apps
    "You have been locked out of QRadar due to too many failed login attempts.
    Please try again later."
    image-20230222152909-4
  • UBA app displays error before redirected to E_LOCKED_OUT:
    "Server response not recognized."
    image-20230222153132-5
     

Cause

Too many failed login attempts from the same host.
 

Diagnosing The Problem

  1. Go to the QRadar Console, web UI:
    https://{IP_or_hostname}/console/
    Note: where {IP_or_hostname} is replaced with your teams QRadar Console's IP address or DNS resolvable hostname. 
  2. Test the Cloud Pak for Security credentials in the QRadar Console, and you receive one of the following errors:
    • QRadar Console, web UI, displays error:
      "The username and password you supplied are not valid. Please try again."
      image-20230222153341-6
    • QRadar Console, web UI, displays error:
      "The host has been temporarily blocked due to too many login attempts. Please try again later."
      image-20230222153454-7
       

Resolving The Problem

Note: the issue and resolution is demoed on YouTube.
 
  1. Have the QRadar Administrator update the CP4S account password from the QRadar Console, web UI.
  2. Have the QRadar Administrator unlock the CP4S user account from the QRadar Console command line-interface, CLI, from either SSH or IMM.
  3. Have the QRadar Administrator unlock the CP4S servers from the QRadar Console command-line interface.
Result
 
Cloud Pak for Security is no longer displaying:
"An error has occurred while displaying content from QRadar. Either return to the homepage and try again or check your settings in the QRadar Proxy configuration. Error code: E_LOCKED_OUT."
 

Document Location

Worldwide

[{"Type":"MASTER","Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSTDPP","label":"IBM Cloud Pak for Security"},"ARM Category":[{"code":"a8m0z0000001jPEAAY","label":"Data Source"}],"ARM Case Number":"","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"All Versions"}]

Document Information

Modified date:
23 February 2023

UID

ibm16957446

Page Feedback