Question & Answer
Question
After upgrading an old QRadar instance to migrate to a new appliance, I performed a backup and restore of the configuration and data as outlined in documentation. Why is every offense now marked as closed?
Cause
The restore process as it is designed, closes all the offenses in the system. This is to avoid issues with the database becoming corrupted. Unfortunately there is no way to reopen or recover those offenses because the system does not allow that type of action. This is because as soon as the offense is closed, it is then possible for a new offense to be created on the same criteria.
Answer
This is the normal behavior of restoring offenses to a new system or restoring to an existing system. This is due to the way offenses are tracked. The trackers aren't migrated because if you get an offense part way through being tracked and then restore on a new system it could get the offenses in a bad state. It is safer to just close the offenses.
Where do you find more information?
Was this topic helpful?
Document Information
Modified date:
16 June 2018
UID
swg21998958