IBM Support

QRadar: Custom email notifications cases and support policies

Question & Answer


Question

This article informs administrators about QRadar® Support policies. Customers can set up rule responses to send email alerts on Events, Flows, and Offenses. When you configure a rule response, administrators can choose the default template or a custom template. The custom template is modified by the administrator by editing the alert-config.xml file.

Answer

Responsibilities for custom email notifications issues

QRadar® has a flexible template of parameters that administrators can use to create a custom email notification template. Due to the configurable nature of the notification templates, support can investigate errors and software issues where rule responses do not generate alerts.

Support type Description Responsibility
Custom email notifications, errors, and support
QRadar® technical support teams can assist administrators with issues implementing the updated configuration file.  Administrators can open cases with QRadar® technical support to:
  1. Confirm the template was modified, validated by the script, and deployed to QRadar managed hosts.
  2. Verify the template option displays in the user interface as an available option for rule responses.
  3. Investigate issues where a rule response does not generate any output or send an email notification to users.
  4. Review errors generated by the validator script.
 QRadar technical support

To open a case or an error for custom email notifications, contact QRadar technical support.
Out-of-scope for QRadar Support Administrators are responsible for their custom email notifications. The following activities are considered out-of-scope for technical support cases:
  1. Editing the contents of the XML file for customers.
  2. Choosing which fields can be used within each template.
  3. Defining rule responses or modifying rules for users.

 
For more information, see the following IBM Documentation:

[{"Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000cwsyAAA","label":"Admin Tasks"}],"ARM Case Number":"","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"All Version(s)"}]

Document Information

Modified date:
16 June 2021

UID

ibm16427791

Page Feedback