IBM QRadar SOAR

IBM QRadar

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only

  • 1.  qradar app : IntegrityError: foreign key constraint failed

    Posted Tue July 21, 2020 02:56 PM
    Hi,

    I'm using qradar resilient integration app v35 for sending two qradar: 


    2020-07-21 21:42:36,616 [datastorage.add_ip_address] [Thread-406] [ERROR] - Failed to insert offense - ip_address pair xxxx-xxx into DB
2020-07-21 21:42:36,617 [datastorage.add_ip_address] [Thread-406] [ERROR] - Traceback (most recent call last):
  File "/app/apis/datastorage.py", line 297, in add_ip_address
    (offense_id, ip_id, is_source))
IntegrityError: foreign key constraint failed

2020-07-21 21:42:36,998 [resilient_helpers.find_qradar_incident] [Thread-406] [INFO] - No existing incident found
2020-07-21 21:42:41,242 [qradar_api_client.create_offense_note] [Thread-406] [INFO] - QRadarAPIClient.create_offense_note(): Successfully created note​

    Is there known bugs in this version? When we send offense manually, we have the above error.

    Any advice would be appreciated.

    Thanks



    ------------------------------
    Jasmine
    ------------------------------


  • 2.  RE: qradar app : IntegrityError: foreign key constraint failed

    Posted Thu July 23, 2020 02:50 PM
    Hi Jasmine,
    Could you elaborate on "for sending two qradar:". I'm not sure if it's a typo or if you're referring to a configuration with 2 QRadar instances.
    I just want to clarify this, because we do not support configuration with 2 QRadar instances, though it's not related to this issue you've messaged us about.
    This error message is not a concern. It happens during local caching, but does not disrupt escalations.

    Hope this helps,

    ------------------------------
    Ihor Husar
    ------------------------------

    Original Message


  • 3.  RE: qradar app : IntegrityError: foreign key constraint failed

    Posted Thu July 23, 2020 03:08 PM
    Hi @Ihor Husar,

    I have two qradar instance. 
    2 qradar instance :: 1 resilient.

    Is the incompatibility of more than one qradar instance exists in mssp license? Because we recently had a POC for mssp and they set many qradar instances to one resilient.

    I appreciated your help.​

    ------------------------------
    Jasmine
    ------------------------------

    Original Message


  • 4.  RE: qradar app : IntegrityError: foreign key constraint failed

    Posted Tue August 18, 2020 09:35 AM
    Hi @Ihor Husar,

    ​Is the incompatibility of more than one qradar instance exists in mssp license? Because we recently had a POC for mssp and they set many qradar instances to one resilient.

    I appreciated your help.​

    ------------------------------
    Jasmine
    ------------------------------

    Original Message


  • 5.  RE: qradar app : IntegrityError: foreign key constraint failed

    Posted Tue August 18, 2020 09:50 AM
    Hello Jasmine,

    It does exist in MSSP license as well. This does not mean that your PoC was misconfigured, since that incompatibility exists specifically with multiple mappings to the same organizations.
    We are working on some changes to support such configurations, but currently it's not available.

    ------------------------------
    Ihor Husar
    ------------------------------

    Original Message


  • 6.  RE: qradar app : IntegrityError: foreign key constraint failed

    Posted Tue August 18, 2020 09:55 AM
    Hi Jasmine,
    Additionally, could you let me know who you were in contact with for PoC?
    I could reach out to them to confirm that you've been set up with correct configuration.

    ------------------------------
    Ihor Husar
    ------------------------------

    Original Message


  • 7.  RE: qradar app : IntegrityError: foreign key constraint failed

    Posted Thu August 20, 2020 06:02 AM
    Hi @Ihor Husar,

    I have sent you information privately.

    Best​

    ------------------------------
    Jasmine
    ------------------------------

    Original Message