IBM Support

QRadar: Troubleshooting third-party applications

Troubleshooting


Problem

All applications available on the IBM App exchange that IBM did not develop are considered IBM Business Partner or third-party applications. Third-party applications on the IBM X-Force App Exchange are reviewed and security tested by IBM but are not developed or directly supported by QRadar Support teams.

Diagnosing The Problem

IBM's application validation process and security review process confirms that all applications can be installed without causing functional issues on the QRadar Console or App Host appliance. 

If a third party QRadar application is not working as expected, there are a number of troubleshooting techniques and tools that you can use to help you find and fix the issue. You can also use the log files for the application to help you troubleshoot issues.

QRadar applications are installed in docker containers, and each application has their own logs, which are separate from the QRadar logs. The QRadar logs contain messages and errors about the container infrastructure whereas the application logs contain information specifically about that application.

Resolving The Problem

The following table includes links to the documentation that can help the troubleshooting of QRadar applications:

Documentation Link

QRadar: Third-party applications and support policies

https://www.ibm.com//support/pages/qradar-threat-intelligence-application-third-party-feeds-and-support-policies

QRadar App Troubleshooting: Before Opening a QRadar Support Ticket

https://www.ibm.com/support/pages/node/716891

QRadar: Custom SSL certificate troubleshooting

https://www.ibm.com/support/pages/node/6221256
QRadar application error: 'Cannot establish secure connection to the console. Check whether your QRadar Certificates are set up properly' https://www.ibm.com/support/pages/node/6217361
Review QRadar App logs https://www.ibm.com/support/pages/app-troubleshooting
Running the Recon tool https://www.ibm.com/docs/en/qradar-common?topic=troubleshooting-running-recon-tool

Document Location

Worldwide

[{"Type":"MASTER","Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSV4BL","label":"IBM QRadar"},"ARM Category":[{"code":"a8m0z000000cwt3AAA","label":"QRadar Apps"}],"ARM Case Number":"","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"All Versions"}]

Document Information

Modified date:
14 December 2022

UID

ibm16840727