--- sourceDocument: Zurich Security Management sourceDocumentLink: https://www.servicenow.com/docs/r/zurich/security-management Release : - zurich ft:locale : - en-US ft:publication_title : - Zurich Security Management ft:clusterId : - security bundleId : - security workflow : - Technology --- # Troubleshoot # Troubleshooting IBM QRadar offense ingestion integration {#ariaid-title1} * Release version: Zurich * * Updated July 31, 2025 * * ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read Summarize ![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete. ## Summary of Troubleshooting IBM QRadar Offense Ingestion Integration This guide provides essential troubleshooting tips for the IBM QRadar offense ingestion integration within ServiceNow. It helps users diagnose and resolve common issues encountered during the ingestion of offenses from IBM QRadar into ServiceNow Security Incident Response. Show full answer Show less ## Integration Run Monitoring * Each scheduled job execution produces an integration run record containing logs, errors, warnings, the count of offenses pulled, and incidents created. * Users with the **snsi.analyst** role can view errors, failed profiles, and access worknotes with links to executed subflows for detailed investigation. * The **sneventingestionintegrationrun** table stores error records useful for troubleshooting. ## SSL and Certificate Management * When connecting to IBM QRadar cloud instances, ensure the instance has a valid, non-expired CA certificate. * RSA or custom certificates can be imported into the platform, and the certificate's common name must match the host name. ## Profile Configuration and Validation * Complete profiles by clicking the **Finish** button in Additional Options to move the profile to a Waiting state, ready for ingestion. * Validate integration health by checking profile states, last pull dates, and records in offense import and offense-to-task tables. ## MID Server Setup (On-Premise) * After configuring the MID server, create a MID server application, and use its name in integration settings instead of the MID server name. * Default MID server timeout is 30 seconds; this can be disabled with caution due to system-wide impact. ## Offense Updates and Incident Creation * If delays occur in incident creation and the **snsecqradar.getoffenseupdates** property is enabled, disable this property. * Avoid enabling this property when polling intervals are low and offense load is high to prevent queue overload. ## Handling Missing Data in Security Incidents * If event, flow, remoteip, or user data is missing, increase the timeout value of the **snsecqradar.sidttl** parameter. * Longer timeouts allow complete parsing of offenses before incident creation. ## Timeout Issues in Flow Designer Actions Timeout errors can be addressed by reviewing and adjusting the duration parameters (in milliseconds) for key Flow Designer actions involved in offense ingestion and connection validation: * Fetch Sample Offenses * Fetch Offenses for profile and queue records * REST wrappers for testing connection and validating API credentials * REST step for IBM QRadar offense updates Adjusting these timeout settings helps accommodate network latency or system performance variations, ensuring smoother integration runs. This section covers important troubleshooting tips and frequently asked questions related to IBM QRadar offense ingestion. * Integration run: When a scheduled job starts executing, an integration run record with logs, errors, and warnings is displayed. The number of offenses pulled and the number of incidents created in a scheduled job run are also displayed. Users with the sn_si.analyst role can see if any errors/profiles pulling failed during the integration run. Worknotes in the integration run provide links to the executed subflows. Users with the sn_si.analyst role can check the `sn_event_ingestion_integration_run` table for any errors that have occurred. To troubleshoot any integration issues, you must first check the integration run. Errors are logged as worknotes in the integration run records for every scheduled job run. * SSL issues: When connecting to IBM QRadar cloud instances, ensure that the instance has a valid CA certificate which has not expired. You can import RSA or your own certificates into the platform and ensure that the common name of the certificate matches host name. See [https://support.servicenow.com/nav_to.do?uri=%2Fkb_view.do%3Fsys_kb_id%3D55ecefd61bf3774cada243f6fe4bcb44](https://support.servicenow.com/nav_to.do?uri=/kb_view.do?sys_kb_id=55ecefd61bf3774cada243f6fe4bcb44) for details. * Incomplete profile: While configuring the profile, in the Additional Options ([Automate offense updates and closure based on SIR incident status](https://www.servicenow.com/docs/eI1iosIdMJRGJmJlEt77iw "The IBM QRadar integration has a bi-directional interface that allows for both offenses to create security incidents, as well as an ability to update the offenses once the security incident is created and/or closed with relevant incident details such as security incident number, assignment group, security incident URL, and so on.")) section, you must click the Finish button to ensure that the profile is moved to Waiting state indicating that it is waiting for ingestion. * Validate profile: To validate if the integration is working correctly, check the profile states, last pulled date of profile, offense import table, offense to task table records. * MID server configuration: If you are installing the IBM QRadar application on-premise, after configuring the MID server, you must create a MID server application. The MID server application name should be used in integration configurations tile instead of the MID server name. Note: The default MID serve timeout is 30 seconds. To see instructions on disabling the timeout period, see \. Note that this is a system-wide change and may impact other integrations. * Offense Updates: If you have enabled the sn_sec_qradar.get_offense_updates property and you notice a delay in the creation of security incidents, then disable the property. Do not enable this property when the polling interval is low and the offenses load on QRadar is high as this increases the queue load. * Missing event, flow data, remote_ip, or users data in a security incident: If you observe that event, flow data, remote_ip, or users data is missing in a security incident, then increase the timeout (seconds) for sn_sec_qradar.sid_ttl parameter. Increasing the duration delays the creation of the security incident until the AQLs complete parsing each offense. * Timeouts: If you view timeout errors in the application logs, review and modify the following flow designer actions:{#ibm-qradar-trouble__table_pbg_yvf_qnb__entry__2} | Parameters | Action | |-|-| | Fetch Sample Offenses `var flow_outputs = sn_fd.FlowAPI.executeAction('sn_sec_qradar.fire_rest_for_offenses', flow_inputs, 60000);` | Review and update the duration in milliseconds. | | Fetch Sample Offenses `var flow_outputs = sn_fd.FlowAPI.executeAction('sn_sec_qradar.fire_rest_for_offenses', flow_inputs);` | Add a parameter for the executeAction and enter the duration in milliseconds. | | Fetch Offenses for profile and queue records in polling table `var flow_outputs = sn_fd.FlowAPI.executeAction('sn_sec_qradar.fire_rest_for_offenses', flow_inputs, 180000);` | Review and update the duration in milliseconds. | | Wrapper for testing connection REST `var rest_outputs = sn_fd.FlowAPI.executeAction('sn_sec_qradar.test_connection_rest', rest_inputs);` | Add a parameter for the executeAction and enter the duration in milliseconds. | | Wrapper for validating API credentials REST `var rest_outputs = sn_fd.FlowAPI.executeAction('sn_sec_qradar.validate_credentials_rest', rest_inputs);` | Add a parameter for the executeAction and enter the duration in milliseconds. | | REST step for IBM QRadar Offense updates `var result = sn_fd.FlowAPI.executeAction('sn_sec_qradar.'+restStep, inputs,60000);` | Review and update the duration in milliseconds. | [Table 1. Flow designer actions] {#ibm-qradar-trouble__table_pbg_yvf_qnb} {#ibm-qradar-trouble__ul_kd4_cdf_vkb}