Hi folks. I have a new installation of Qradar - Console, 1 even processor, 2 even collectors, 1 flow processor, 2 flow collectors (if that matters).
I have a few security profiles setup that give access to specific networks and log sources. When I assign those security profiles to users, all of the default dashboards (application overview, network overview, system monitoring) break. Unless a user has the Admin security profile attached, each graph returns the message: No results returned for this item. However, if you click "View in log activity" on each of these graphs, the Log Activity Window opens, the search is run, and the data is graphed as I would expect.
If I change any of the dashboard items to "1 minute", it displays the data just fine. Capture time series data is not checked. While checking this makes some dashboards work over time, I can not go in and change this for every single user I add to the system.
Users with the Admin security profile work fine, but I need role based access. For example, I can't give our network team access to AD logs, so they have a specific security profile with those roles.
I have been working with IBM support for 3 weeks now and I don't feel that they are knowledgeable of how the security profiles should affect the dashboard. They have been unable to provide a solution. I am running 2.3.1 patch 5 and was told not to go to patch 6 (just yet?).
Has anyone come across this issue or can guide me to fixing it? The default canned dashboards should just work without requiring every user to be an admin.
Appreciate the help!