Troubleshooting
Problem
When saving the the application you see a message, such as, "Connected Successfully! Action configuration check failed: [Action close_offense has wrong number of conditions] Some features of this app will not be available" written to the application.
The message returned may vary.
Symptom
When clicking "Verify and Configure" a message might be returned referring to the close_offense or qradar_note rules that exist in IBM Resilient.
Cause
The reason for this message is because either the IBM Resilient rules, close_offense or qradar_note, have the wrong conditions.
The message, "Connected Successfully! Action configuration check failed: [Action close_offense has misconfigured conditions] Some features of this app will not be available" is caused by the rule having the correct number of conditions but one of the conditions is configured incorrectly.
The message, "Connected Successfully! Action configuration check failed: [Action close_offense has wrong number of conditions] Some features of this app will not be available" is caused by the rule having too many or too few conditions.
The message, "Connection and Configuration Verification Failed: unsupported operand type(s) for +: 'NoneType' and 'unicode' " is caused when one of the additional conditions added is incorrect such as adding the conditions "incident is created" or "incident is deleted."
The above messages can also apply to the qradar_note rule.
Diagnosing The Problem
Check the close_offense or qradar_note rules in IBM Resilient to make sure it has the correct conditions.
The rule close_offense can have one or two conditions as of the latest version of the application.
Resolving The Problem
Modify the rules so they are the default values. If you do not know what the default values should be then you may perform these steps.
- Delete the rule from IBM Resilient - Customization Settings - Rules - qradar_note/close_offense
- In the application, accessible from the IBM QRadar console, ensure that "Enable Configuring Resilient" is checked
- Click "Verify and Configure"
The deleted rule will be re-created with the correct conditions.
Document Location
Worldwide
[{"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSIP9Q","label":"IBM Security SOAR"},"ARM Category":[{"code":"a8m0z0000001gyGAAQ","label":"Integrations-\u003EQRadar app"}],"ARM Case Number":"","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"All Version(s)","Line of Business":{"code":"LOB24","label":"Security Software"}},{"Type":"MASTER","Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSEGM63","label":"IBM Security QRadar SOAR on Cloud"},"ARM Category":[{"code":"a8m0z0000001gyGAAQ","label":"Integrations-\u003EQRadar app"}],"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"All Versions"}]
Was this topic helpful?
Document Information
Modified date:
15 August 2022
UID
ibm16254477