Hi,

I'm using qradar resilient integration app v35 for sending two qradar: 

2020-07-21 21:42:36,616 [datastorage.add_ip_address] [Thread-406] [ERROR] - Failed to insert offense - ip_address pair xxxx-xxx into DB
2020-07-21 21:42:36,617 [datastorage.add_ip_address] [Thread-406] [ERROR] - Traceback (most recent call last):
  File "/app/apis/datastorage.py", line 297, in add_ip_address
    (offense_id, ip_id, is_source))
IntegrityError: foreign key constraint failed

2020-07-21 21:42:36,998 [resilient_helpers.find_qradar_incident] [Thread-406] [INFO] - No existing incident found
2020-07-21 21:42:41,242 [qradar_api_client.create_offense_note] [Thread-406] [INFO] - QRadarAPIClient.create_offense_note(): Successfully created note​

Is there known bugs in this version? When we send offense manually, we have the above error.

Any advice would be appreciated.

Thanks

------------------------------
Jasmine
------------------------------

Hi Jasmine,
Could you elaborate on "for sending two qradar:". I'm not sure if it's a typo or if you're referring to a configuration with 2 QRadar instances.
I just want to clarify this, because we do not support configuration with 2 QRadar instances, though it's not related to this issue you've messaged us about.
This error message is not a concern. It happens during local caching, but does not disrupt escalations.

Hope this helps,

------------------------------
Ihor Husar
------------------------------

Hi @Ihor Husar,

I have two qradar instance. 
2 qradar instance :: 1 resilient.

Is the incompatibility of more than one qradar instance exists in mssp license? Because we recently had a POC for mssp and they set many qradar instances to one resilient.

I appreciated your help.​

------------------------------
Jasmine
------------------------------

Original Message:
Sent: Thu July 23, 2020 02:50 PM
From: Ihor Husar
Subject: qradar app : IntegrityError: foreign key constraint failed

Hi Jasmine,
Could you elaborate on "for sending two qradar:". I'm not sure if it's a typo or if you're referring to a configuration with 2 QRadar instances.
I just want to clarify this, because we do not support configuration with 2 QRadar instances, though it's not related to this issue you've messaged us about.
This error message is not a concern. It happens during local caching, but does not disrupt escalations.

Hope this helps,

------------------------------
Ihor Husar
------------------------------

Hi @Ihor Husar,

​Is the incompatibility of more than one qradar instance exists in mssp license? Because we recently had a POC for mssp and they set many qradar instances to one resilient.

I appreciated your help.​

------------------------------
Jasmine
------------------------------

Original Message:
Sent: Thu July 23, 2020 02:50 PM
From: Ihor Husar
Subject: qradar app : IntegrityError: foreign key constraint failed

Hi Jasmine,
Could you elaborate on "for sending two qradar:". I'm not sure if it's a typo or if you're referring to a configuration with 2 QRadar instances.
I just want to clarify this, because we do not support configuration with 2 QRadar instances, though it's not related to this issue you've messaged us about.
This error message is not a concern. It happens during local caching, but does not disrupt escalations.

Hope this helps,

------------------------------
Ihor Husar
------------------------------

Hello Jasmine,

It does exist in MSSP license as well. This does not mean that your PoC was misconfigured, since that incompatibility exists specifically with multiple mappings to the same organizations.
We are working on some changes to support such configurations, but currently it's not available.

------------------------------
Ihor Husar
------------------------------

Original Message:
Sent: Tue August 18, 2020 09:35 AM
From: Jasmine
Subject: qradar app : IntegrityError: foreign key constraint failed

Hi @Ihor Husar,

​Is the incompatibility of more than one qradar instance exists in mssp license? Because we recently had a POC for mssp and they set many qradar instances to one resilient.

I appreciated your help.​

------------------------------
Jasmine
------------------------------


Original Message:
Sent: Thu July 23, 2020 02:50 PM
From: Ihor Husar
Subject: qradar app : IntegrityError: foreign key constraint failed

Hi Jasmine,
Could you elaborate on "for sending two qradar:". I'm not sure if it's a typo or if you're referring to a configuration with 2 QRadar instances.
I just want to clarify this, because we do not support configuration with 2 QRadar instances, though it's not related to this issue you've messaged us about.
This error message is not a concern. It happens during local caching, but does not disrupt escalations.

Hope this helps,

------------------------------
Ihor Husar

Hi Jasmine,
Additionally, could you let me know who you were in contact with for PoC?
I could reach out to them to confirm that you've been set up with correct configuration.

------------------------------
Ihor Husar
------------------------------

Original Message:
Sent: Tue August 18, 2020 09:35 AM
From: Jasmine
Subject: qradar app : IntegrityError: foreign key constraint failed

Hi @Ihor Husar,

​Is the incompatibility of more than one qradar instance exists in mssp license? Because we recently had a POC for mssp and they set many qradar instances to one resilient.

I appreciated your help.​

------------------------------
Jasmine
------------------------------


Original Message:
Sent: Thu July 23, 2020 02:50 PM
From: Ihor Husar
Subject: qradar app : IntegrityError: foreign key constraint failed

Hi Jasmine,
Could you elaborate on "for sending two qradar:". I'm not sure if it's a typo or if you're referring to a configuration with 2 QRadar instances.
I just want to clarify this, because we do not support configuration with 2 QRadar instances, though it's not related to this issue you've messaged us about.
This error message is not a concern. It happens during local caching, but does not disrupt escalations.

Hope this helps,

------------------------------
Ihor Husar

Hi @Ihor Husar,

I have sent you information privately.

Best​

------------------------------
Jasmine
------------------------------

Original Message:
Sent: Tue August 18, 2020 09:54 AM
From: Ihor Husar
Subject: qradar app : IntegrityError: foreign key constraint failed

Hi Jasmine,
Additionally, could you let me know who you were in contact with for PoC?
I could reach out to them to confirm that you've been set up with correct configuration.

------------------------------
Ihor Husar
------------------------------


Original Message:
Sent: Tue August 18, 2020 09:35 AM
From: Jasmine
Subject: qradar app : IntegrityError: foreign key constraint failed

Hi @Ihor Husar,

​Is the incompatibility of more than one qradar instance exists in mssp license? Because we recently had a POC for mssp and they set many qradar instances to one resilient.

I appreciated your help.​

------------------------------
Jasmine


Original Message:
Sent: Thu July 23, 2020 02:50 PM
From: Ihor Husar
Subject: qradar app : IntegrityError: foreign key constraint failed

Hi Jasmine,
Could you elaborate on "for sending two qradar:". I'm not sure if it's a typo or if you're referring to a configuration with 2 QRadar instances.
I just want to clarify this, because we do not support configuration with 2 QRadar instances, though it's not related to this issue you've messaged us about.
This error message is not a concern. It happens during local caching, but does not disrupt escalations.

Hope this helps,

------------------------------
Ihor Husar