Known Issues

Unable to use APIs outside of QRadar in QRadar Use Case Manager 3.1.0

In version 3.1.0, custom integrations might stop working, resulting in the inability to connect to the QRadar Use Case Manager APIs from outside your QRadar environment. The workaround in QRadar Use Case Manager 3.1.0 or later is to authenticate the API calls by using the same token that is used on the Configuration page (add a SEC header in the API call). If you upgrade to version 3.2.0 or later and use the token that you used to configure QRadar Use Case Manager, the custom integrations work.

Commonly referenced elements appear with different names

Commonly referenced elements, such as log sources, custom properties, or reference sets, can appear with old names in QRadar Use Case Manager and the rule details section in QRadar. QRadar Use Case Manager retrieves the names of elements that are referenced by rule tests from the text in the rule XML. When a referenced element changes its name, the text in the rule XML is not updated. As a work-around, you can edit the rule in the rule wizard in QRadar Use Case Manager and save it (click Finish without changing anything) to resolve the text mismatch.

QRadar Use Case Manager updates log source type names in the rule within 15 minutes of the update, or when you explicitly refresh the rule.

Unable to Search for the Forward Slash Character in Regex

The app cannot search for the forward slash character (/) in regular expressions. For example, on the Use Case Explorer page in the rule name or test definition in the filters, and rule name in the search bar of the table. As a work-around, use a question mark (?) as a wild character.

Corrupted Custom Rule Prevents Using Related Functions

A corrupted rule in QRadar prevents the QRadar API from returning required data. This prevents the QRadar Use Case Manager app from using rule-related functions.