In the QRadar GUI. you notice that no new offenses were generated today. A review of the notifications shows: MPC: Unable to create new offense. The…

The notification "MPC: Unable to create new offense. The maximum number of active offenses has been reached" is generated by the Magistrate Processing Component (MPC) in QRadar. This occurs when the number of open, active offenses meets a predefined system limit, which is designed to maintain system performance. The default value for this limit is 2,500 active offenses. When this threshold is reached, QRadar stops creating new offenses until existing ones are closed or the limit is increased by an administrator. This setting is controlled by the OFFENSECREATIONMAXACTIVEOFFENSES parameter in the nva.conf file.

A. 3500: This is not the default configured value for the maximum number of active offenses in QRadar.

B. 1500: This is not the default configured value for the maximum number of active offenses in QRadar.

C. 5000: This is not the default configured value for the maximum number of active offenses in QRadar.

1. IBM QRadar Administration Guide: In the section discussing system settings, the OFFENSECREATIONMAXACTIVEOFFENSES parameter is detailed. The guide specifies, "The default value is 2500. When the number of active offenses reaches the value that is specified by this parameter, a system notification is sent and no new offenses are created." (Reference: IBM QRadar Administration Guide, System Settings chapter, Offense management section).

2. IBM Support Technote KB0021943: This official support document directly addresses the notification in the question. It states, "By default, the maximum number of active offenses is 2,500. When this value is reached, QRadar generates the 'MPC: Unable to create new offense...' notification and stops creating new offenses." (Source: IBM Support, Document Number: KB0021943, "QRadar: 'MPC: Unable to create new offense. The maximum number of active offenses has been reached' notification").

3. IBM Knowledge Center - QRadar on Cloud: The documentation for managing system settings lists various tunable parameters. For OFFENSECREATIONMAXACTIVEOFFENSES, it confirms, "The maximum number of active offenses that can be in the system. Default: 2500." (Source: IBM Knowledge Center, IBM QRadar on Cloud, "Managing system settings").