No tocken header present in request. Content pack install

You did not mention your specific QRadar version in your question, but my guess is that your logs are reporting this issue: https://www.ibm.com/community/qradar/home/apars/?IJ21456

We've seen the 'No token header present in request' errors when the content pack is trying to import a large content addon or when the importer (CMT) is looking for a reference value that does not exist. It could also be that if you are on QRadar on Cloud that a large content install is hitting the session timeout limit.

I think you should get a case opened to confirm this issue. You could look to see if /var/log/qradar.log if there is an error 'Failed to apply custom logic.', but if you are using QRadar on Cloud, you do not have access to the command-line interface for that appliance type.

I do not know what QRadar version you are on, but an upgrade could fix this issue or you could get help from a support representative by submitting your logs in a case (https://www.ibm.com/mysupport/CommunitiesLogin?startURL=/s/createrecord/NewCase).

Support has a workaround that can assist by updating an spconfig value, but we'd need to confirm the problem and there is not much to go on in this forum post.

If you open a case, make sure you include the following:

• QRadar version
• Content pack that is generating the error
• Logs from your Console (https://ibm.biz/qradarlogs)

Hi,

I am using QRadar SIEM version 7.3.2 on prem.

Thank you for your help.

William