Opencti addon on Splunk cluster

[splunkreal]

Hello, is Splunk opencti addon compatible on Splunk cluster (shc)?

From 2/3 search heads we are getting this error: "2025-10-09 16:22:56,618 ERROR pid=31312 tid=MainThread file=base_modinput.py:log_error:309 | Error in ListenStream loop, exit, reason: HTTPSConnectionPool(host='sXXX.XXX.XXX', port=8080): Max retries exceeded with url: /stream/4484559f-66f8-4107-9afc-1d9c141377fb?recover=2025-07-22T10:27:24Z (Caused by SSLError(SSLError(1, '[SSL: UNKNOWN_PROTOCOL] unknown protocol (_ssl.c:1143)')))"

Even if we are not configured as SSL.

Thanks.

[livehybrid]

Hi @splunkreal 

Can you confirm, are you expecting it to be http or https? The code for this app enforces SSL vertification if using https. 

Can you also check the ta_opencti_add_on_settings.conf file in $SPLUNK_HOME/etc/<appDir>/local on the SH to confirm they are all the same and that its using the expected protocol?

You might also find this answer helpful: 

https://community.splunk.com/t5/Getting-Data-In/Why-can-t-I-download-from-OpenCTI-Stream-Feed-into-S...

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

[splunkreal]

Hi @livehybrid yes it's http, do you use it on SHC cluster? We are using v1.1.5 FYI