Hi Team, We have configuring Symantec ATP Add-on to receive Symantec ATP logs on Splunk. We have defined App as ATP and got the Client ID and Client Secret on ATP manager (HTTP event collector already configured), when we are configuring add-on on Splunk HF we are successfully able to authenticate from Symantec ATP. When searching the logs on Search Head with query sourcetype = Symantec* getting below error ERROR 140385235900224 - Symantec ATP Manager: Exception while getting ATP manager host Traceback (most recent call last): File "/opt/splunk/etc/apps/TA-symantec_atp/bin/atp_manager_utility.py", line 110, in get_atp_manager_user_credentials sessionKey=session_key) File "/opt/splunk/lib/python2.7/site-packages/splunk/entity.py", line 129, in getEntities atomFeed = getEntitiesAtomFeed(entityPath, namespace, owner, search, count, offset, sort_key, sort_dir, sessionKey, uri, hostPath, **kwargs) File "/opt/splunk/lib/python2.7/site-packages/splunk/entity.py", line 222, in _getEntitiesAtomFeed serverResponse, serverContent = rest.simpleRequest(uri, getargs=kwargs, sessionKey=sessionKey, raiseAllErrors=True) File "/opt/splunk/lib/python2.7/site-packages/splunk/rest/init_.py", line 516, in simpleRequest raise splunk.AuthorizationFailed(extendedMessages=uri) AuthorizationFailed: [HTTP 403] Client is not authorized to perform requested action; https://127.0.0.1:8089/servicesNS/nobody/TA-symantec_atp/storage/passwords?count=-1&search=TA-symantec_atp Thanks in Advance ... View more