All Apps and Add-ons

The Splunk Add-on for Check Point OPSEC LEA stopped and I received the following error: "SIC ERROR 119 - SIC Error for lea: Client could not choose an authentication method for service lea"

SirHill17
Communicator

Hello,

I setup the OPSEC LEA Add-on and did all the configuration required. It worked for 2 weeks and suddenly it stopped.

I tried to reset all the configurations from scratch after multiples tentative but no success.

Now I am able to setup the configuration and pull the SIC certificate.

Unfortunately, when I add an inputs, I am getting the below error message in the _internal logs:

2018-09-18 14:42:08,846 +0000 log_level=ERROR, pid=8911, tid=Thread-9, file=ta_opseclea_data_collector.py, func_name=get_logs, code_line_no=75 | [input_name="GVA-MDS-PRI" connection="GVA-MDS" data="non_audit"]log_level=0 file:lea_loggrabber.cpp func_name:check_session_end_reason code_line_no:1056 :ERROR: Session end reason: SIC ERROR 119 - SIC Error for lea: Client could not choose an authentication method for service lea

I have already taken a look at the other forum discussion, but none of them provided solutions that worked for me.

Does anyone have an idea how to resolve this?

Thanks for your help.

SirHIll

0 Karma
1 Solution

SirHill17
Communicator

Issue resolved resetting the SIC password.

View solution in original post

0 Karma

SirHill17
Communicator

Issue resolved resetting the SIC password.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...