QRadar: Security Operations Integration - Sightings Search execution failed : Error code : 422 Method Failed - Support and Troubleshooting

QRadar: Security Operations Integration - Sightings Search execution failed : Error code : 422 Method Failed Issue Refer: Get started with the IBM QRadar - Incident Enrichment integration When you run the " Run Sightings Search", this will create Records in the sn_si_incident table Open the Associates TASKS TAB, you will see the records created for the sn_si_incident table. In the sn_si_incident record, if you see in the activities as below:

Automation activity• mm-dd-yyyy 11:01:47 AM Workflow Security Operations Integration - Sightings Search execution completed. No sightings found. Implementation workflow Security Operations - QRadar Sightings Search failed: Error communicating with QRadar server. If you open this workflow , you will see the below error , see the screen shot attached. QRadar: Security Operations Integration - Sightings Search execution failed : Error code : 422 Method Failed

Cause QRadar Version is different than the QRadar API Version.

IBM QRadar - Incident Enrichment - QRadar https:// .service-now.com/nav_to.do?uri=sn_sec_core_integration_item.do?sys_id=3c222d211b5848d05251ba2d1e4bcbc2

Integration Item Configuration https:// .service-now.com/sn_sec_core_integration_item_config_list.do?sysparm_query=integration%3D3c222d211b5848d05251ba2d1e4bcbc2%5E

If the API Version is not correct in the above configuration, below error will be thrown: QRadar Integration : error_code":422,"error_message":"Method failed: (/api/ariel/searches) with code: 422

Resolution Update the version value in ServiceNow to match the QRadar API Version

Refer to the IBM QRadar documentation to figure out the QRadar API Version , for further information , please contact IBM QRadar.

QRadar and API versions Every QRadar version has a REST API version, as described in the following table:

Table 1. QRadar and API versions QRadar version REST API version API version support status V7.3.2. n Version 10. n Supported. V7.3.1. n Version 9. n Supported. V7.3.0. n Version 8. n Deprecated in QRadar V7.3.2. V7.2.8. n and earlier Version 7. n and earlier No longer supported. For 7.3.3 Version, the API Version is 12.0, refer the screen shot attached.