IBM QRadar

IBM QRadar

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only
Back to discussions
Expand all | Collapse all

Office 365 Message Trace REST API Protocol issue

  • 1.  Office 365 Message Trace REST API Protocol issue

    Posted Fri May 07, 2021 02:03 PM

    Hi all!

    I added a new source type - Microsoft Office 365 Message Trace. I used the protocol - Office 365 Message Trace REST API.

    When I do the TEST, I get the following error:

    Unable to find any protocol source claiming id [91] on the existing ecs-ec-ingress stack

    I couldn't find any errors in qradar.log and qradar.error .

    Please assist.



    #QRadar
    #Support
    #SupportMigration


  • 2.  RE: Office 365 Message Trace REST API Protocol issue

    Posted Tue May 25, 2021 04:23 PM

    If you haven't already contacted support, you should do so. This issue is likely due to protocol jars missing or not in the proper folder or it could be that ecs-ec-ingress is not loading the jar files properly. There was a known issue logged initially against Amazon AWS as APAR IJ28708 for ecs-ec-ingress not loading files, but depending on your version I would get support to confirm if the correct files are located in the /opt/ibm/si/services/ecs-ec-ingress/eventgnosis/lib/q1labs/ directory.

    If any of the required files are not present, it can cause the error you mentioned. It might also be a deploy issue, but I would get support to confirm if you have not already done so.



    #QRadar
    #Support
    #SupportMigration


Related Content