IBM QRadar

 View Only
  • 1.  qapp deploy from QRadar SDK has Expecting Value message

    Posted Wed September 18, 2024 10:19 AM

    We have tried 3 different hosts and to 2 different QRadar labs.  We have been using the qapp tool to deploy our new app.  We don't know if it was an upgrade or what, we think we have been on the same version of the SDK for a while 2.0.0.  As I mentioned in Reddit when run the qapp script looks for upgrades, so I assume we are on latest version.  

    While attempting to deploy a newer version of an in house developed app, we get the "Expecting value: line 4 column 1 (char 3)", it never attempts to connect to the remote host.  I tried looking at the qapp script to figure out what was being tested on line 4, but my bash scripting is about 8 years stale.

    This is the screenshot of the attempt.  Got the same thing on multiple versions of Ubuntu and RHEL, didn't try windows.  Again, the connection to the remote console is never attempted.  We can see that in the destination qradar in a firewall query. 

    root@LabJumpBox01:/home/user/Downloads# qapp deploy -p app.zip -q 10.120.1.10 -u user 
    Please enter password for user user:
    Expecting value: line 4 column 1 (char 3)



    ------------------------------
    Frank Eargle
    ------------------------------


  • 2.  RE: qapp deploy from QRadar SDK has Expecting Value message

    Posted Wed September 18, 2024 11:49 AM

    Actually the SDK version is QRadarAppSDK-2.2.1.zip.  Sorry, docs and everything show 2.0.0.



    ------------------------------
    Frank Eargle
    ------------------------------



  • 3.  RE: qapp deploy from QRadar SDK has Expecting Value message

    Posted Thu September 19, 2024 02:16 PM
    Edited by Frank Eargle Thu September 19, 2024 02:16 PM

    Found it.  Seems the "qapp deploy" command cannot be used in a SAML or multifactor authentication environment.  You HAVE to be using single factor auth.  

    Would have been nice for the documentation or error messages mentioned that!  



    ------------------------------
    Frank Eargle
    ------------------------------