QRadar XDR

  • 1.  Unable to install Threat Intel app

    Posted Tue August 31, 2021 01:18 PM
    Edited by benlinux Wed September 01, 2021 08:24 AM
    Hello Experts,

    I tried to upgrade my threat intelligence app from 1.4.1 to 2.1.0, and I encountered the error message "The UUID in the application manifest.json file is already in use by another app". I performed the below troubleshooting steps but still not resolved.

    1 psql -U -qradar -c "select id,name,status from installed_application" --> to retrieve the id of my threat intelligence app.
    2 psql -U -qradar -c "delete from installed_application where id='<id of my ap>';" --> To delete the threat intelligence app
    3 /opt/qradar/support/recon ps --> to confirm that the threat intelligence app is deleted.
    4 performed full deploy.

    I accessed the Extension management tool , unfortunately I could still see both my previous app (Threat intel v1.4.1) and the new app (Threat intel v2.1.0) with status as "uninstall previewing" and "install failed" respectively.
    When I tried to delete the old threat intelligence app from the Extension management tool I received the error "Another preview/install/uninstall task is currently in progress. please try again later"

    Kindly assist.

    Thank you in advance.


  • 2.  RE: Unable to install Threat Intel app

    Posted Thu September 16, 2021 08:57 AM
    HI benlinux

    I would suggest opening support ticket to look after the Qradar DB to be updated manually.  Depends on version, there are couple of DB instance to be changed.

    Brian K. 

    Brian Kwak

  • 3.  RE: Unable to install Threat Intel app

    Posted Thu September 16, 2021 09:35 AM
    Hello Brian,

    I have opened a case, and this has been resolved by IBM SE.

    Thanks a lot.


  • 4.  RE: Unable to install Threat Intel app

    Posted Fri October 22, 2021 03:39 PM
    Hello benlinux,

    Do you remember the resolution steps? What you checked on the system and what was to problem there?

    Kind regards

    Hasan Keskin