Splunk TA Cloud Services authentication error Cisco Umbrella user?

dkeck — Mon, 15 May 2023 14:45:34 GMT

Hello,

does anyone here have an idea why cisco cloud security umbrella addon is interfering the authentication within Splunk TA Cloud Services?

I try to ingest nsg flow data via a storage blob. All the other inputs within the Cloud Services TA are working (azure audit data via eventhub). When I disable the umbrella TA nsg flow logs can be received without a problem.

File "/opt/splunk/etc/apps/Splunk_TA_microsoft-cloudservices/lib/solnlib/credentials.py", line 137, in get_password f"Failed to get password of realm={self._realm}, user={user}." solnlib.credentials.CredentialNotExistException: Failed to get password of realm=__REST_CREDENTIAL__#Splunk_TA_microsoft-cloudservices#configs/conf-inputs, user=cisco_cloud_security_umbrella_addon://UmbrellaDNS.

Feels like some python issue?

Thankful for any hint I can get.

David

Re: Splunk TA Cloud Services authentication error Cisco Umbrella user?

dkeck — Tue, 04 Jul 2023 12:58:03 GMT

I moved the umbrella TA to a different HF. Wokred for me, but still just a workaround.

topic Re: Splunk TA Cloud Services authentication error Cisco Umbrella user? in Getting Data In

Splunk TA Cloud Services authentication error Cisco Umbrella user?

Re: Splunk TA Cloud Services authentication error Cisco Umbrella user?