Troubleshooting

Common issues encountered when deploying and operating the CICADA IR incident response platform, along with solutions. Covers web interface access, licence activation, data source connections (Entra ID, Defender, CrowdStrike, Active Directory), threat intelligence enrichment, AI analysis with Ollama, Anthropic Claude, OpenAI, and Google Gemini, and performance tuning. If your issue is not covered here, contact support at support@cicada-ir.ai.

Cannot reach the web interface

If you cannot load the CICADA IR web UI in your browser after booting the VM:

1. Check the VM is running: Open your hypervisor console and confirm the VM has booted. The console displays a banner with the IP address once services are ready. Allow 1–2 minutes after boot for all services to start.
2. Verify the URL: Make sure you are using https:// (nothttp://) followed by the IP shown on the VM console banner.
3. Accept the certificate warning: CICADA IR ships with a self-signed TLS certificate. Your browser will show a security warning. Click Advanced and then Proceed (or equivalent in your browser) to continue.
4. Check network connectivity: From your workstation, test if you can reach the VM:

   # From your workstation (macOS/Linux)
   ping <vm-ip>
   
   # Or on Windows
   ping <vm-ip>
   
   # If ping works but the web page doesn't load, port 443 may be blocked
   # by your workstation firewall or corporate network

5. Check hypervisor networking: Ensure the VM's network adapter is configured correctly in your hypervisor:
   • Bridged mode: The VM gets its own IP on your network (recommended)
   • NAT mode: The VM shares the host's IP. You may need port forwarding to access it
   See the Setup Guide for platform-specific networking instructions.
6. Reboot the VM: If the console banner is not showing or the IP is missing, try a clean restart from your hypervisor.
7. Check for a held update: If the console banner says UPDATE HELD, see An update is held below.
8. Did you upload a TLS certificate? See Web interface unreachable after uploading a certificate below.

Web interface unreachable after uploading a certificate

If the web interface stopped answering after you uploaded your own TLS certificate and restarted the appliance, the web server may not be able to use that certificate. Replace it with a self-signed certificate from the appliance console:

1. Open the VM console in your hypervisor and restart the VM.
2. At the boot prompt, press [N] for network settings.
3. The wizard says the appliance is using an uploaded TLS certificate and asks whether to replace it. Choose Replace. The default answer is Keep, so move to Replace before pressing Enter.
4. The appliance makes a self-signed certificate for its hostname and address and restarts the web server. The wizard shows the result and then opens the network settings; choose Cancel there if you do not want to change them.
5. Sign in at https:// and the IP address on the console banner, accept the self-signed certificate warning, and upload a certificate that meets the certificate requirements.

If the wizard does not ask about the certificate, the appliance is on a version without this option. Contact support.

Browser shows NET::ERR_CERT_COMMON_NAME_INVALID

The name in the address bar is not in the certificate's Subject Alternative Name. Browsers ignore the Subject name (Common Name), so the error appears even when the Subject name matches exactly and the certificate chains to a root your computers trust. This is how every current browser checks certificates; CICADA has no setting that changes it.

1. Open the certificate in the browser and look at Details > Subject Alternative Name.
2. If the name you browse to is not listed, reissue the certificate with that name in the Subject Alternative Name, upload it, and restart the appliance. See Put every name users type in the Subject Alternative Name.
3. Until then, sign in using a name that is listed.

An update is held

When an update fails, the appliance puts the previous version back and starts it. If it cannot do that completely, it leaves the CICADA service stopped rather than run the previous version on data that is only partly restored. The web interface then does not load, and the console banner shows UPDATE HELD: the web interface is stopped.

1. Restart the appliance from your hypervisor. Every boot tries the recovery again, continuing from where it stopped. If the console shows Finishing an interrupted update, wait for it; this can take several minutes.
2. If the banner still says UPDATE HELD after a restart, contact support at support@cicada-ir.ai with the version you were installing and when. Keep the VM and do not delete it: its disk holds your data.
3. To get running again from a backup, power the held VM off and keep it. Create a new VM from the current image (see the Setup Guide), then restore your most recent .cicada-backup file under Settings > General > System Backup & Restore. Anything recorded after that backup is lost. Read Backups first: on a new VM the product key must be entered again, and evidence chains verify only once support has set up the signing key they name.

Setup wizard issues

Licence activation fails

You enter your product key in the setup wizard's License Activation step, or later on the Activation page (sidebar, under System). If the key is refused, an Activation Failed notice shows one of these messages.

There is no grace period after a key expires: paid features switch off and the appliance runs as Community Edition until you enter a valid key. For the last 30 days before expiry, every page shows a banner with the expiry date.

Did not receive the activation email

• Check your spam/junk folder for an email from noreply@cicada-ir.ai
• Verify you entered the correct email address on the pricing page
• If you use a corporate email with strict filtering, ask your IT team to allow emails from cicada-ir.ai
• If you still haven't received the email after 10 minutes, contact support@cicada-ir.ai with the email address you used

Data source connection issues

Microsoft Entra ID / Defender connection fails

If the Test Connection button fails when configuring a Microsoft data source:

• Verify your Azure App Registration: Ensure the Tenant ID, Client ID, and Client Secret are correct and the app has the required API permissions (see Getting Started)
• Check secret expiry: Azure client secrets expire. If the secret was created more than 6–24 months ago, generate a new one in the Azure portal
• Verify API permissions: The app registration needs the correct Microsoft Graph permissions and they must be admin-consented
• Network access: The VM needs outbound HTTPS access to login.microsoftonline.com and graph.microsoft.com. Ask your network team to whitelist these if the VM is behind a restrictive firewall (see Network Requirements)

CrowdStrike connection fails

• Verify the API Client ID and Secret are correct
• Ensure you are using the correct API base URL for your CrowdStrike cloud:
  • US-1: api.crowdstrike.com
  • US-2: api.us-2.crowdstrike.com
  • EU-1: api.eu-1.crowdstrike.com
• Check that the API client has the required scopes in the CrowdStrike console

Active Directory (on-prem) connection fails

• The VM must be able to reach your domain controller on port 636 (LDAPS) or 389 (LDAP), and on 88 in the Kerberos modes. This typically requires the VM to be on the same network or have a route to the DC.
• Verify the service account credentials and ensure the account is not locked or expired. The rights it needs are on the Active Directory account page.
• CICADA checks the domain controller's certificate before it sends any password, in every authentication mode: on 636 (LDAPS), and on 389 after it starts TLS (StartTLS). The certificate must chain to a CA the appliance trusts, be in date, and carry the domain controller name you entered. A refused certificate gives The certificate presented by … was not accepted (…). No password was sent. If your domain's own CA (AD CS) issued it, paste that CA's certificate into the source's CA certificate field (see Active Directory). If the message says the certificate is not issued for the name, enter the domain controller as the DNS name on its certificate.
• Over HTTPS (port 5986) the WinRM certificate is checked the same way: the CA, the dates, and the host's name in its Subject Alternative Name. A refusal says The WinRM certificate presented by …:5986 was not accepted, with the reason. See WinRM over HTTPS.
• In the Kerberos modes the domain controller must be entered by DNS name, the appliance's DNS must resolve it, and the appliance clock must be within five minutes of the domain.

Threat intelligence enrichment not working

If IOC lookups return no results or show errors:

• Check API keys: Navigate to Settings > Threat Intelligence and verify that API keys are configured for the providers you want to use
• Rate limits: Free-tier API keys have strict limits:

  Provider	Free tier limit
  VirusTotal	4 requests/minute
  AbuseIPDB	1,000 requests/day
  Shodan	1 request/second

  If you are running large investigations with many IOCs, lookups may be throttled. CICADA IR queues and retries automatically, but results may take longer to appear.
• Network access: The VM needs outbound HTTPS access to the TI provider APIs. See Network Requirements for the full list.

AI analysis issues

AI analysis returns an error

If using Ollama (local LLM running on your network):

• Ollama runs on a separate host on your network, not on the CICADA IR VM itself. If AI analysis fails, check the Ollama host is running and reachable.
• Confirm the Ollama URL in Settings > AI Configuration points to the host's IP (e.g., http://192.168.1.50:11434), not localhost.
• Confirm Ollama is bound to 0.0.0.0, not just localhost. From any machine on the same network, run curl http://<ollama-host-ip>:11434/api/tagsto verify.
• Check that the model name in Settings > AI Configuration matches a model installed on the Ollama host. Run ollama list on that host.
• See the AI Setup guide for the full configuration.

If using a cloud LLM (Anthropic, OpenAI, or Google Gemini):

• Verify the API key is configured in Settings > AI Configuration
• Check that the VM has outbound HTTPS access on port 443 to the provider endpoint:
  • Anthropic: api.anthropic.com
  • OpenAI: api.openai.com
  • Google Gemini: generativelanguage.googleapis.com
  Ask your network team to whitelist the one you're using.
• Verify your API key has sufficient credits in the provider's console: Anthropic, OpenAI, Google AI Studio.

AI analysis is slow

• Local LLMs (Ollama): Speed depends on the resources of the host running Ollama (CPU, RAM, and especially GPU). A CPU-only host with 8 GB RAM takes 30–120 seconds per analysis. A host with an NVIDIA GPU takes 2–10 seconds. If inference is slow, move Ollama to a host with more resources or add a GPU.
• Cloud LLMs: Typically respond in 10–30 seconds. If responses are slower, check your network latency to the provider endpoint.

Performance issues

Slow evidence collection

• Large timeframes: Collecting 90 days of sign-in logs for a tenant with thousands of users takes time. Narrow the timeframe or target specific users/entities to speed up collection.
• API throttling: Microsoft Graph and CrowdStrike enforce rate limits. CICADA IR handles throttling automatically with exponential backoff, but heavy collection may take longer. A progress indicator is shown during collection.
• Network latency: If the VM is on a slow network link, data transfers will be slower. Ensure the VM has a reliable network connection.

Web interface is slow or unresponsive

• Increase VM resources: If the web UI feels sluggish, the VM may need more CPU or RAM. We recommend at least 4 vCPUs and 8 GB RAM for typical workloads.
• Close completed investigations: Active investigations consume memory. Archive completed investigations through Investigations > Archive to free resources.
• Restart the VM: If the interface becomes unresponsive, restart the VM from your hypervisor. All investigation data is saved to disk and will be available after restart.

Download issues

Download link expired

Sign in at cicada-ir.ai/account to get a new download link. If you can't sign in, email support@cicada-ir.ai.

Which image format do I need?

Browser compatibility

CICADA IR is tested and supported on:

• Google Chrome (latest)
• Microsoft Edge (latest)
• Mozilla Firefox (latest)
• Safari 17+

If you experience display or functionality issues:

• Try clearing your browser cache and refreshing the page
• Disable browser extensions that may interfere (ad blockers, privacy extensions)
• Try an incognito/private window to rule out extension conflicts

Still need help?

If your issue is not covered above, contact CICADA IR support. Please include:

• A description of the issue and when it started
• The error message (if any). A screenshot is helpful
• Your CICADA IR version (shown in the bottom-left of the web interface)
• Your hypervisor type and VM resource allocation
• Any recent changes to your environment (network, data sources, etc.)

Email: support@cicada-ir.ai