IBM Support

QRadar: Imported reference sets with blank values can cause watchlist display issues in UBA

Troubleshooting


Problem

In the User Behavior Analytics app, users might not display in the Watchlist on the UBA Overview tab. Missing users can occur when a reference set contains blank username in a UBA Watchlist. Administrators who experience blank Watchlists can review the UBA reference set data and remove blank entries.

Symptom

The users do not display in the Watchlist, rendering a blank window. This issue occurs, the following error displays in the app logs:
Poll.log
[sync_watchlist_membership.run] [ERROR] - Error adding members via reference set: 'NoneType' object has no attribute 'strip'

Cause

The most common cause of this error is a blank value accidentally being added when users copy and paste long strings of input.

Resolving The Problem

Administrators who experience this error must log in and delete the blank entries in the Value column from the reference set.
  1. Log in to QRadar as an administrator.
  2. On the Admin tab, click the Reference Set Management icon.
    image-20221019105734-1
  3. Locate the Reference Set used by the Watchlist. In this example, the Reference Set used is called "Usernames".
  4. Double-click the reference set to open up the Content tab.
  5. Click the Value column to filter blank values in ascending order.
    image-20221020113948-1
  6. Select any rows that contain a blank Value column.
  7. Click Delete.
  8. Click the UBA tab.
  9. Click the Refresh icon or wait for the user interface to count down and update the user interface.

    Result
    Confirm the Watchlist displays values correctly in the user interface. If you continue to experience Watchlist interface issues after you remove the blank entries from the Values column in the reference set, contact QRadar Support.

Document Location

Worldwide

[{"Type":"MASTER","Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000cwt3AAA","label":"QRadar Apps"}],"ARM Case Number":"","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"All Versions"}]

Document Information

Modified date:
25 October 2022

UID

ibm16587987

Page Feedback