Troubleshooting
Problem
Updating a QRadar Data Connector Access Configuration with a new Authentication Token does not update, and continues to use the original Authentication Token in Cloud Pak for Security.
Diagnosing The Problem
- Log in to QRadar.
- Create new Authentication Token to be used for the Data Connector access.
- Log in to Cloud Pak for Security (CP4S).
- Go to the upper left stack select Connections > Data Sources > select a QRadar
Data Source
to edit. - Scroll to Configuration.
- Select the edit pen for any of the access configurations.
- Press the Reset value for the Authentication Token.
- Input the new Token created within QRadar, from step 2.
- Save the configuration.
- Save the Data Connector.
- Go to TII.
- Select a report, or bundle.
- Run a scan against the Data Connector Access that was updated with the new Authentication Token.
- SSH to the QRadar Console.
- Check logs to verify whether new token is in use:
grep "<new authentication token name>" /var/log/audit/audit.log
grep "<old authentication token name>" /var/log/audit/audit.log
Resolving The Problem
- Log to Cloud Pak for Security (CP4S).
- Go to upper left stack and select Connections > Data Sources > select the problem QRadar
Data Source
to DELETE - Delete the nonworking Access Configuration.
- Make a new Access Configuration with the new QRadar Authentication Token.
- Ensure that the rest of the access was put back in place for the users.
- Save the configuration.
- Save the Data Connector.
- Go to TII and select a report, or bundle.
- Run a scan against the Data Connector Access that was updated with the new Authentication Token.
- Go to QRadar.
- SSH into the QRadar console.
- Verify logs show the new token use:
cd /var/log/audit grep "<new authentication token name>" audit.log
Document Location
Worldwide
[{"Type":"MASTER","Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSTDPP","label":"IBM Cloud Pak for Security"},"ARM Category":[{"code":"a8m0z0000001jPEAAY","label":"Support-\u003EData Source"}],"ARM Case Number":"","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"1.9.0"}]
Was this topic helpful?
Document Information
Modified date:
24 April 2023
UID
ibm16985039