Cb Response App for Splunk: Error "Unknown error reading API Key"

[naqviah]

I am try to use a process search feature in the CB-Response app. I am receiving the following error:

error: unknown error reading api key from credential storage: http 403 forbidden -- you (user=XXXXXXX) do not have permission to perform this operation (requires capability: list_storage_passwords).

I have already checked the following:
- Account permissions - set to admin
- capability (list_storage_passwords) already added to the role
- Permissions on the app directory recursively

Not sure what I am missing out.
Any help would be appreciated.

[carbonblack]

We haven't seen that error in the past - we use the Splunk Password Storage REST API endpoints to store the credentials in an encrypted manner. Can you send us an email at [email protected] and we can set up a shared session to try and troubleshoot what may be occurring?

Thanks
- Jason