Question & Answer
Question
This article informs administrators of their responsibilities for upgrading IBM QRadar SOAR deployments, how software upgrade cases are handled, and discusses out-of-scope work for the IBM Support team.
Answer
Technical help for IBM QRadar SOAR software upgrades allows users with valid support contracts to receive troubleshooting assistance for technical issues and answers to common questions from administrators. The IBM Support team can assist administrators with basic planning, installation issues, and post-installation issues or questions. This document also describes work that is considered out-of-scope for IBM Support and provides support alternatives for issues that cannot be addressed in a support case.
Technical support can assist administrators with:
IBM QRadar SOAR upgrade cases are handled differently depending on whether you are in the middle of an upgrade compared with during the planning stage.
Upgrade Planning Support
Planning phase IBM QRadar SOAR upgrade cases are usually marked with a lower case severity (Severity 2-4). IBM Support typically recommends administrators run through the IBM QRadar SOAR upgrade checklist first.
In-progress Upgrade Support
IBM QRadar SOAR software upgrade failures or errors are generally treated as system down cases (Severity 1). After a technical problem is resolved, support representatives will generally disengage from the Webex while the administrator continues the software upgrade.
Upgrade Validation Support
Post-upgrade functionality checks are to be done by the administrators and cases can be opened if issues are found. Software defects and issues discovered can range in severity (Severity 1-4). How-to-questions and usage questions related to new features are assigned a lower severity (Severity 4). This kind of questions maybe better asked within the IBM QRadar SOAR Community and the IBM Support team might direct you there.
Due to the highly flexible nature of IBM QRadar SOAR, a deep understanding of your use-cases, environment, and overall security strategy is crucial to formulate an effective upgrade plan. IBM Support does not have this knowledge about your deployment, so the following activities are considered out-of-scope for support cases:
IBM QRadar SOAR software upgrade assistance
Technical support can assist administrators with:
- Interpreting software installation and upgrade documentation. See the 'Upgrade Planning Support' tab.
- Basic planning and pre-upgrade checklist questions. See the 'Upgrade Planning Support' tab.
- Troubleshooting for administrators on supported versions. See the 'In-progress Upgrade Support' tab.
- Analysis of logs and errors during software upgrades. See the 'In-progress Upgrade Support' tab.
- Issue confirmation for problems experienced after completing a software upgrade. See the 'Upgrade Validation Support' tab.
Severity and handling of software upgrade cases
IBM QRadar SOAR upgrade cases are handled differently depending on whether you are in the middle of an upgrade compared with during the planning stage.
Upgrade Planning Support
Planning phase IBM QRadar SOAR upgrade cases are usually marked with a lower case severity (Severity 2-4). IBM Support typically recommends administrators run through the IBM QRadar SOAR upgrade checklist first.
In-progress Upgrade Support
IBM QRadar SOAR software upgrade failures or errors are generally treated as system down cases (Severity 1). After a technical problem is resolved, support representatives will generally disengage from the Webex while the administrator continues the software upgrade.
Upgrade Validation Support
Post-upgrade functionality checks are to be done by the administrators and cases can be opened if issues are found. Software defects and issues discovered can range in severity (Severity 1-4). How-to-questions and usage questions related to new features are assigned a lower severity (Severity 4). This kind of questions maybe better asked within the IBM QRadar SOAR Community and the IBM Support team might direct you there.
IBM Security Expert Labs assistance
Due to the highly flexible nature of IBM QRadar SOAR, a deep understanding of your use-cases, environment, and overall security strategy is crucial to formulate an effective upgrade plan. IBM Support does not have this knowledge about your deployment, so the following activities are considered out-of-scope for support cases:
- Developing or creating upgrade strategies for administration teams.
- Recommending IBM QRadar SOAR version upgrades based on security posture.
- Completing the IBM QRadar SOAR upgrade checklist for administrators.
- Managing or completing software upgrades across multiple appliances or deployments.
- Providing dedicated support (staying online with you) during the normal upgrade process.
- Running post-upgrade system health checks or performance checks.
Clients are responsible for completing the steps from IBM QRadar SOAR upgrade checklist before you begin your software upgrade. Administrators who have questions or concerns about the software upgrade checklist can open a case for technical support.
IBM QRadar SOAR software upgrade planning assistance
Technical support for IBM QRadar SOAR can assist administrators with the following upgrade planning tasks:
- Answer questions for administrators about software upgrades or questions regarding IBM upgrade documentation.
- Notifying IBM Support staff when your planned upgrades are scheduled. If you provide us with a date and time for the planned upgrade activity, IBM Support can make the support team that is on shift during the upgrade aware so that they know to expect possible contact from you.
- Software upgrade planning cases will not remain open during or after the upgrade. Due the dispersed nature of the team open a case when required so that it is routed to the team that is working as this might differ from the owner of the software upgrade planning case.
Important: Due to case schedules, time zones, and case hand-offs, responses can be provided from multiple support engineers. IBM does not dedicate a single point of contact for software upgrade activities, even if the date and time of the maintenance window is provided. If you require a dedicated IBM point of contact to manage the software upgrade and validation, you can contact IBM Security Expert Labs.
Out-of-scope software planning tasks
The following planning activities are considered out-of-scope for IBM Support:
- Developing, reviewing, or maintaining upgrade strategies for your IBM QRadar SOAR deployment.
- Recommending which version of IBM QRadar SOAR to upgrade to.
- Completing the IBM QRadar SOAR upgrade checklist for administrators.
Due to the intensive and involved nature of IBM QRadar SOAR upgrades, software upgrade must be performed by the client. Performing a software upgrade for administrators is not within the normal capabilities of a support engineer and is considered “out-of-scope”. Technical support is not able to start, monitor, or manage software upgrades for the administrators.
IBM QRadar SOAR software upgrade cases
Administrators who encounter software errors that prevent a successful upgrade can open a Severity 1 case for priority assistance. Your case must describe the problem and it is recommended that you provide secondary contact information or a backup contact for your case. It is recommended that you call IBM QRadar SOAR support by using the out of hours number listed in Support details for IBM QRadar SOAR Incident Response Platform. The person receiving the call asks for some basic information (a valid callback number and email address). They then contact the on-call Support Engineer who will get back to you shortly.
Out-of-scope software upgrade cases
The following case activities are considered out-of-scope:
- Managing software upgrades after errors are resolved. For example, completing software upgrades on other appliances after resolving a software issue.
- Providing dedicated support (staying online with you) during the normal upgrade process.
- Staying on a Webex for extended periods of time waiting for administrators with special permissions to join.
Post-installation technical issues are not necessarily considered system down. Any issue reported after a recent software upgrade must be opened by the client as a new support case.
IBM QRadar SOAR software upgrade validation assistance
After administrators upgrade their software, they should review the appliance to ensure that it is functioning as expected. If you identify an issue, IBM Support can assist with new cases to confirm any errors or perform extra troubleshooting.
Administrators can open new cases after a successful upgrade for assistance with:
Administrators can open new cases after a successful upgrade for assistance with:
- Troubleshooting errors for software features that do not function properly after a successful software upgrade.
Out-of-scope software validation cases
The following post-upgrade activities are considered out-of-scope for IBM Support:
- Completing system health checks for administrators.
- Validating the status of Disaster Recovery appliances or running failover tests on appliances.
- Planning future software updates for organizations.
Related Information
[{"Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSIP9Q","label":"IBM Security SOAR"},"ARM Category":[{"code":"a8m0z000000cwJWAAY","label":"Support"}],"ARM Case Number":"","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"All Version(s)"}]
Was this topic helpful?
Document Information
Modified date:
15 November 2022
UID
ibm16348684