In the cofense addon https://splunkbase.splunk.com/app/5253/
this confused me for a while on what the credentials where
tried adding the username and passwords in the credentials, by which I thought it means the username and password you use to access the gui
In the cofense v2API we can create
Client ID:
Client Secret:
but that doesnt seem to work with app (think its V1)
Found eventually under Account mangement that a User can create an API V1 key
so use the logui gin as the username and the API as the password
It now seems obvious , put posting for thick people like me , who might find this useful
You might modify the title with [Solution] or add the answer and select your own answer as the solution. Just so that anyone else having the issue knows that this is an answer and not just someone else asking for help with the same problem.