IBM Support

The IBM Resilient app does not load when opening it in the IBM QRadar console

Troubleshooting


Problem

When clicking on the IBM Resilient app in the IBM QRadar console you may find it does not load.

Symptom

The app not being able to load means that you cannot configure the app as expected.
Manual and automatic escalations and synchronisation should remain unaffected but some behaviour relating to reference sets may not work.

Cause

This can be caused by a large reference set causing the IBM Resilient app to time out because a response from the IBM QRadar console has returned within 60 seconds.

Diagnosing The Problem

Connect to the container running the app on the console or AppHost using recon or docker commands. More information about how to do this is in What information is required when engaging support with IBM QRadar/Resilient application problems?
Once you are inside the container, look at /store/log/app.log. The log may show output such as this.
2020-11-24 17:16:20,298 [qradar_api_client._rest] [Thread-22] [ERROR] - Traceback (most recent call last):
  File "/app/apis/qradar_api_client.py", line 164, in _rest
    response = self._perform_request(full_url, method, headers, data, json_data)
  File "/app/apis/qradar_api_client.py", line 186, in _perform_request
    return qpylib.strategy().REST(method, full_url, headers=headers, data=data, json_inst=json_data)
  File "/app/qpylib/live_qpylib.py", line 135, in REST
    timeout=timeout, verify=verify)
  File "/app/qpylib/abstract_qpylib.py", line 55, in RESTget
    data=data, json=json_inst, timeout=timeout)
  File "/root/.local/lib/python2.7/site-packages/requests/api.py", line 70, in get
    return request('get', url, params=params, **kwargs)
  File "/root/.local/lib/python2.7/site-packages/requests/api.py", line 56, in request
    return session.request(method=method, url=url, **kwargs)
  File "/root/.local/lib/python2.7/site-packages/requests/sessions.py", line 488, in request
    resp = self.send(prep, **send_kwargs)
  File "/root/.local/lib/python2.7/site-packages/requests/sessions.py", line 609, in send
    r = adapter.send(request, **kwargs)
  File "/root/.local/lib/python2.7/site-packages/requests/adapters.py", line 499, in send
    raise ReadTimeout(e, request=request)
ReadTimeout: HTTPSConnectionPool(host='qradar-console.domain.com', port=443): Read timed out. (read timeout=60)
It indicates that the app cannot connect to the IBM QRadar console.
Run further checks to ensure that the container can indeed connect to the console.
curl –v –k https://qradar-console.domain.com:443
If the container can connect to the console, then check that the reference set information can be loaded. This can be checked with either the Reference Data Management app or in the Admin tab by opening the Reference Set Management page found under system configuration. If these do not load or take a very long time to load, then you may have one or more reference sets with many elements.

Resolving The Problem

In one instance it was seen that a particular reference set had over a million elements stopping the Reference Set Management page from loading.
In instances such as this, work with IBM QRadar support by raising a case for further advice as to how to decrease the number of elements. Once this problem has been rectified the IBM Resilient app will be able to load.

Document Location

Worldwide

[{"Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSIP9Q","label":"IBM Security SOAR"},"ARM Category":[{"code":"a8m0z0000001gyGAAQ","label":"Integrations-\u003EQRadar app"}],"ARM Case Number":"","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"All Version(s)"}]

Document Information

Modified date:
19 April 2021

UID

ibm16410468

Page Feedback