A persistent issue with the Threat Intelligence App in the JSA deployment:

The app doesn't progress past the Loading screen with the message "Downloading Security Collections from IBM X-Force Exchange".
 

Steps to reproduce:

1. Login to the JSA console WebUI.

2. Open the Threat Intelligence App by going to the Admin tab > Threat Intelligence App.

3. Observe that the app gets stuck on the loading screen with the message "Downloading Security Collections from IBM X-Force Exchange".

4. Also, you can see the issue if navigate to the Admin tab> QRadar Assistant.

5. Find the Threat Intelligence app: Threat Intelligence – QRadar v7.3.3 FP9+/7.4.1 FP2+. 

6. The following error will be observed: "This extension is not signed properly. You can check this extension in the Extension Management UI for more details."

The app doesn't progress past the Loading screen with the message "Downloading Security Collections from IBM X-Force Exchange".

Additionally, an error message is displayed in the app manager regarding the App's signature: "This extension is not signed properly. You can check this extension in the Extension Management UI for more details."

Here are our recommendations:

• You need to check which authorized token is configured. Ensure it is an "admin/admin" token under Admin > Authorized Services. If it is an old one then create a new token.  Creating an Authorized Service Token.

Reinstall procedure: If replacing the token does not work, please reinstall the Threat Intelligence app with the steps shared below:

1. Login to the JSA console or Apphost CLI, once in the CLI type the following command (/opt/qradar/support/qappmanager) and check for the <app id> of the Threat Intelligence app, under App definitions and App instances.

2. In JSA GUI go to the Admin tab> Extension Management > Threat Intelligence:

   1. On the installed tab then click on the threat intelligence app. 

   2. Click on the Uninstall button.

3. Make sure the Threat intelligence app is no longer visible under installed apps under the Admin tab, Extension Management dialog box.

4. Login to the JSA console or Apphost CLI and check if the Threat intelligence app is no longer visible using (/opt/qradar/support/qappmanager | grep <app id>) utility, you must check both sections: App definitions and App instances, you shouldn't see any entries that contain Threat Intelligence.

5. Also, the Console/App host CLI confirms that the container has stopped running:

   1. # docker ps | grep <app id>

6. You can use the Qradar assistant or login to the App exchange to download the latest version of the Threat Intelligence app.

7. Then go to JSA GUI> Admin > Extension Management > Click Add to install the app.

If this doesn't work, please open a JTAC case using the following link: Contact Juniper Support