Managed hosts in a deployment contact the Console's Apache server to send cached requests. After X-Force data is received by the JSA Console, the result is cached and replayed for all other managed hosts that make a request for new IP reputation data. This article explains the issue and suggests a workaround.

Users cannot see any data updated in following locations:

/opt/qradar/dca/dca/init/dca_ipr/update                                
/opt/qradar/dca/dca/init/dca_update/update                            
/opt/qradar/dca/dca/init/dca_urlclassification/update   

If you have a proxy configured in your network, administrators will need to update httpd on the console in order to pass-through the existing request and to also send the request through the proxy server in order to receive the X-Force data.

NOTE: NTLM authentication is not supported.

1. Use SSH to log in to the JSA Console.
2. Open the  /etc/httpd/conf.d/ssl.conf  file in a text editor.
3. Add the following lines before :

   ProxyRemote https://license.xforce-security.com/ http://PROXY_IP:PROXY_PORT
   
   ProxyRemote https://update.xforce-security.com/ http://PROXY_IP:PROXY_PORT

4. Update the IP address and port of the corporate proxy server to allow an anonymous connection to the X-Force security servers.
5. Save the changes to the  ssl.conf  file.
6. Restart the tomcat service by typing the following command:

   For JSA release 7.2.8 and lower: 

   service tomcat restart

   
   For JSA release 7.3.0 and higher: 

   systemctl restart tomcat

   Important:
   Restarting the tomcat service on the JSA console logs out all users;  the managed hosts might produce error messages. Restart the tomcat service during scheduled maintenance windows.

2019-06-20: Updated the KB with service restart command for JSA release 7.3.0 and higher.