The Splunk Add-on for Check Point OPSEC LEA stopped and I received the following error: "SIC ERROR 119 - SIC Error for lea: Client could not choose an authentication method for service lea"

[SirHill17]

Hello,

I setup the OPSEC LEA Add-on and did all the configuration required. It worked for 2 weeks and suddenly it stopped.

I tried to reset all the configurations from scratch after multiples tentative but no success.

Now I am able to setup the configuration and pull the SIC certificate.

Unfortunately, when I add an inputs, I am getting the below error message in the _internal logs:

2018-09-18 14:42:08,846 +0000 log_level=ERROR, pid=8911, tid=Thread-9, file=ta_opseclea_data_collector.py, func_name=get_logs, code_line_no=75 | [input_name="GVA-MDS-PRI" connection="GVA-MDS" data="non_audit"]log_level=0 file:lea_loggrabber.cpp func_name:check_session_end_reason code_line_no:1056 :ERROR: Session end reason: SIC ERROR 119 - SIC Error for lea: Client could not choose an authentication method for service lea

I have already taken a look at the other forum discussion, but none of them provided solutions that worked for me.

Does anyone have an idea how to resolve this?

Thanks for your help.

SirHIll

[SirHill17 · Accepted solution]

Issue resolved resetting the SIC password.