IBM Support

QRadar: Offense IDs not in sequence

Question & Answer


Question

Why are my offenses not in sequence? The ID of my offenses is skipped, for example after my last offense that has the ID of 345, the next one has an ID of 347. 

Answer

There are times when customers might notice that offense IDs are skipped or not in sequence. By default, the offense IDs are kept in a cache. If for any reason, the MPC component is restarted on the console or there are some problems with it, the numbering could be affected. This does not mean that the offense is lost. It just means that instead of an offense being assigned ID 1, it could be assigned ID 4. 

[{"Type":"MASTER","Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000cwtiAAA","label":"Performance"}],"ARM Case Number":"","Platform":[{"code":"PF016","label":"Linux"}],"Version":"All Versions"}]

Document Information

Modified date:
01 November 2023

UID

ibm17045752