IBM Support

QRadar SOAR: Unable to use the new Secret option with the fn_utilities app

Troubleshooting


Problem

Receiving Invalid Credentials error when using a Secret in the fn_utilities section of the app.config
333, in _send_message_request raise InvalidCredentialsError("the specified credentials were rejected by the server") winrm.exceptions.InvalidCredentialsError: the specified credentials were rejected by the server

Cause

Using an incorrect format in the app.config.
Secret Name= Windows_logon

app.config in the [fn_utilities] section

remote_computer_windows = (domain\user:$Windows_logon@server)

Resolving The Problem

If an app contains account credentials, such as a user name and password, the credentials are stored in the app.config file by default. Optionally, you can store all passwords in secrets for additional security. A secret contains the password but is stored in the container environment where it is not easily accessible. The secret name is entered in the app.config file instead of the password.

When you define a secret (let’s call it Windows_logon), you can embed the entire line with the password . Then in app.config, just refer to that secret:
remote_computer_windows = $Windows_logon
image 9158

App.config in the app section [fn_utilities] - see line 11

remote_computer_windows = $Windows_logon

image 9159

Document Location

Worldwide

[{"Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU048","label":"IBM Software"},"Product":{"code":"SSIP9Q","label":"IBM Security SOAR"},"ARM Category":[{"code":"a8m0z0000001jTpAAI","label":"Integrations-\u003EAppHost"}],"ARM Case Number":"TS005343798","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"All Version(s)"}]

Document Information

Modified date:
31 May 2024

UID

ibm16441419