Troubleshooting
Problem
The recipients of the QRadar EDR reports still receive reports even when their EDR instances are removed.
Diagnosing The Problem
This is not an issue:
- The report is set to send to many recipients, and the instances of one recipient is deleted. That recipient won't receive the report.
- The report is set to send to only one recipient, whose instances are deleted. The report are also deleted.
This is an issue:
The report are set to send to one or more groups, and the instances of one or more than one groups are deleted.
Resolving The Problem
Remove emails that shouldn't get the report
- Go to Scheduled Report > Create Scheduled Report > Automatically send to.
- In Enter your emails here, remove the email addresses of the recipients who no longer needs to receive the reports.
Delete the report
- Click Reports.
- Click a report in the reports list.
- Click Remove.
Document Location
Worldwide
[{"Type":"MASTER","Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSS3Y22","label":"IBM Security QRadar Suite - EDR"},"ARM Category":[{"code":"a8m3p000000hBSBAA2","label":"Administrative Tasks->Reports"}],"ARM Case Number":"","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"All Versions"}]
Was this topic helpful?
Document Information
Modified date:
25 October 2023
UID
ibm17058243