QRadar Support: How to reopen a support case for QRadar
Users who have worked a case with IBM QRadar have 30 days after the case has been closed to reopen the issue. This technical note advises users what to include when they need to reopen a case with QRadar and how to proceed if your case is archived.
- Closed by (IBM or Client)
Any case that is less than 30 days old from the initial closure can be reopened using the Reopen case button. The reopen case button is only available for 30 days from the date of closure at which the status transitions to Closed - Archived.
- Closed - Archived
Cases that are 'Closed - Archived' cannot be reopened. If you experience an issue where a problem appears again and more than 30 days has elapsed there is no reopen button displayed the in the cases user interface. If your case has a status of 'Closed - Archived', QRadar Support recommends that you open a new case and explain this issue. Make sure you record the case number from your archived case and reference in your new support ticket.
How should QRadar users proceed if you cannot reopen your case?
When you enter information for your new case, make sure you note in the business impact area that you are reopening a case that was previously closed and provide the case number (TS000xxxxxx) in your summary.
In the section How is this issue impacting your business users can provide similar text as described below to inform us that you are experiencing a repeat issue. Ensure that you include an new symptoms or workarounds applied to QRadar in your new case. For example:
“We are experiencing an issue for a case that was previously closed. It appears that the issue logged in TS000xxxxxx is still occurring on our appliance. Our previous case has a status of 'Closed - Archived' and cannot be reopened. We have attempted the reapplied the previous workaround with different results. If a support representative can contact us via phone at xxx-xxx-xxx or reach out to us via email (firstname.lastname@example.org) we'd like further assistance on this issue. New logs are attached to this case from the QRadar Console.”