IBM Security QRadar

Hi all,

after installing this app on the environment detailed below, I´m getting an "console's server IP address could not be found." error. (nothing has been documented so far regarding the possible issues)

Would appreciate any help with the issue...thanks!!

The environment:

IBM QRadar
7.5.0 UpdatePackage 7 (Build 20230822112654)
   with interim fix IF04 applied
Tuning template is Enterprise

------------------------------
Vedran Zulin
------------------------------

Additionally, I can´t dig anything out from the logs - it all indicates that the error shouldn´t be there - e.g. (from startup.log in the app directory):

"Attempting to update hosts file with FQDN if present in environment variables
FQDN and console ip found in environment variables, will add to hosts file if required
Hosts entry already present in /etc/hosts, skipping"

For now, the only thing that might indicate an issue is the following:
"CRIT Server 'unix_http_server' running without any HTTP authentication checking"

------------------------------
Vedran Zulin

Original Message:
Sent: Mon May 13, 2024 06:39 AM
From: Vedran Zulin
Subject: IBM Security QRadar Analyst Workflow - console IP not found error?

Hi all,

after installing this app on the environment detailed below, I´m getting an "console's server IP address could not be found." error. (nothing has been documented so far regarding the possible issues)

Would appreciate any help with the issue...thanks!!

The environment:

IBM QRadar
7.5.0 UpdatePackage 7 (Build 20230822112654)
   with interim fix IF04 applied
Tuning template is Enterprise

------------------------------
Vedran Zulin
------------------------------

Hello, 

As you have upgraded to the latest version of you will no longer see the icon for Analyst Workflow as functionality has merged with Pulse application.

There are more details on this change in this official link: https://community.ibm.com/community/user/security/blogs/jeremy-goldstein1/2020/06/09/announcing-qradar-analyst-workflow-rebuilt-for-the

When you watch the installation part from 1:55 onwards it shows you how to access the Analyst UI. 

• Access the QRadar Analyst Workflow by using one of the following methods:
  • In the navigation menu, click Try the New UI.
  • Access the new UI in your browser at https://<QRadar IPaddress>/console/ui.

Ensure you have cleared your browser cache and refresh the browser window before using the app.

Regards

Additionally, I can´t dig anything out from the logs - it all indicates that the error shouldn´t be there - e.g. (from startup.log in the app directory):

"Attempting to update hosts file with FQDN if present in environment variables
FQDN and console ip found in environment variables, will add to hosts file if required
Hosts entry already present in /etc/hosts, skipping"

For now, the only thing that might indicate an issue is the following:
"CRIT Server 'unix_http_server' running without any HTTP authentication checking"

------------------------------
Vedran Zulin

Original Message:
Sent: Mon May 13, 2024 06:39 AM
From: Vedran Zulin
Subject: IBM Security QRadar Analyst Workflow - console IP not found error?

Hi all,

after installing this app on the environment detailed below, I´m getting an "console's server IP address could not be found." error. (nothing has been documented so far regarding the possible issues)

Would appreciate any help with the issue...thanks!!

The environment:

IBM QRadar
7.5.0 UpdatePackage 7 (Build 20230822112654)
   with interim fix IF04 applied
Tuning template is Enterprise

------------------------------
Vedran Zulin
------------------------------

Hi and many thanks for the quick reply!

I´ve tried all of the above, however after the "Try the New UI" page seemingly starts loading, I get the following message:

Hello, 

As you have upgraded to the latest version of you will no longer see the icon for Analyst Workflow as functionality has merged with Pulse application.

There are more details on this change in this official link: https://community.ibm.com/community/user/security/blogs/jeremy-goldstein1/2020/06/09/announcing-qradar-analyst-workflow-rebuilt-for-the

When you watch the installation part from 1:55 onwards it shows you how to access the Analyst UI. 

• Access the QRadar Analyst Workflow by using one of the following methods:
  • In the navigation menu, click Try the New UI.
  • Access the new UI in your browser at https://<QRadar IPaddress>/console/ui.

Ensure you have cleared your browser cache and refresh the browser window before using the app.

Regards

Additionally, I can´t dig anything out from the logs - it all indicates that the error shouldn´t be there - e.g. (from startup.log in the app directory):

"Attempting to update hosts file with FQDN if present in environment variables
FQDN and console ip found in environment variables, will add to hosts file if required
Hosts entry already present in /etc/hosts, skipping"

For now, the only thing that might indicate an issue is the following:
"CRIT Server 'unix_http_server' running without any HTTP authentication checking"

------------------------------
Vedran Zulin

Original Message:
Sent: Mon May 13, 2024 06:39 AM
From: Vedran Zulin
Subject: IBM Security QRadar Analyst Workflow - console IP not found error?

Hi all,

after installing this app on the environment detailed below, I´m getting an "console's server IP address could not be found." error. (nothing has been documented so far regarding the possible issues)

Would appreciate any help with the issue...thanks!!

The environment:

IBM QRadar
7.5.0 UpdatePackage 7 (Build 20230822112654)
   with interim fix IF04 applied
Tuning template is Enterprise

------------------------------
Vedran Zulin
------------------------------

Additionally, what I´m getting while trying to troubleshoot the "Try the New UI" page not being able to open is:

"Failed to load resource: the server responded with a status of 404 (404)"

"Refused to execute script from 'https://ENVIRONMENT_DOMAIN_NAME_HERE/console/ui/static/console/core/js/c.js' because its MIME type ('text/html') is not executable, and strict MIME type checking is enabled."

Hi and many thanks for the quick reply!

I´ve tried all of the above, however after the "Try the New UI" page seemingly starts loading, I get the following message:

Hello, 

As you have upgraded to the latest version of you will no longer see the icon for Analyst Workflow as functionality has merged with Pulse application.

There are more details on this change in this official link: https://community.ibm.com/community/user/security/blogs/jeremy-goldstein1/2020/06/09/announcing-qradar-analyst-workflow-rebuilt-for-the

When you watch the installation part from 1:55 onwards it shows you how to access the Analyst UI. 

• Access the QRadar Analyst Workflow by using one of the following methods:
  • In the navigation menu, click Try the New UI.
  • Access the new UI in your browser at https://<QRadar IPaddress>/console/ui.

Ensure you have cleared your browser cache and refresh the browser window before using the app.

Regards

Additionally, I can´t dig anything out from the logs - it all indicates that the error shouldn´t be there - e.g. (from startup.log in the app directory):

"Attempting to update hosts file with FQDN if present in environment variables
FQDN and console ip found in environment variables, will add to hosts file if required
Hosts entry already present in /etc/hosts, skipping"

For now, the only thing that might indicate an issue is the following:
"CRIT Server 'unix_http_server' running without any HTTP authentication checking"

------------------------------
Vedran Zulin

Original Message:
Sent: Mon May 13, 2024 06:39 AM
From: Vedran Zulin
Subject: IBM Security QRadar Analyst Workflow - console IP not found error?

Hi all,

after installing this app on the environment detailed below, I´m getting an "console's server IP address could not be found." error. (nothing has been documented so far regarding the possible issues)

Would appreciate any help with the issue...thanks!!

The environment:

IBM QRadar
7.5.0 UpdatePackage 7 (Build 20230822112654)
   with interim fix IF04 applied
Tuning template is Enterprise

------------------------------
Vedran Zulin
------------------------------