Symantec Advanced Threat Protection (ATP) APP for Splunk add on gets an error "Failed to authenticate host using provide credentials".

Products

• Endpoint Detection and Response
• Advanced Threat Protection Platform

Issue/Introduction

When trying to add new credentials in the Symantec ATP APP for Splunk add on gets an error " Failed to authenticate host using provide credentials" when trying to configure the Symantec Email Security.cloud Configuration.

Resolution

1) Verify you can login to https://clients.messagelabs.com with the new username and password

2) Verify the new login has the appropriate permission assigned (View Statistics)

3) Verify you are able to log into https://datafeedapi.symanteccloud.com

If you have verified all the above and still receiving the error message the passsword.conf may be corrupted, modify or deleted then you will want to uninstall the Symantec ATP add on APP from Splunk and reinstall the APP again then apply your credentials for the Symantec Email Security.cloud.

Installation Guide